Broadcast profile updates so member lists stay live (no reload needed)

Another user's new display name or avatar didn't show up until you
reloaded -- update_profile/upload_avatar/remove_avatar never told
anyone. Same root cause and fix shape as #26 (room_added): the
frontend's already-fetched member list had no way to hear about a
change, since nothing ever pushed one.

Reuses the existing per-room broadcast channel (not the per-user one
#26 added, since this only matters for rooms the affected user shares
with someone currently looking at them) -- publishes member_updated to
every room the user belongs to; ChatShellPage refetches members when
it arrives for the currently open room.

Verified end-to-end in the browser: one user's room-info member list
updated live when another user changed their display name from a
separate session, no reload.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/test_broadcast.py

@@ -134,3 +134,29 @@ def test_add_member_notifies_target_user_via_websocket(ws_client_factory, monkey
 
         received = bob_ws.receive_json()
         assert received == {"type": "room_added", "room_id": room["id"]}
+
+
+def test_profile_update_notifies_room_members_via_websocket(ws_client_factory, monkeypatch):
+    # Only reaches clients that have the room's own channel joined --
+    # exactly the case where a stale avatar/display name would actually be
+    # visible on screen (a room the user has open right now).
+    _fake_send_email(monkeypatch)
+
+    instance1 = ws_client_factory()
+    instance2 = ws_client_factory()
+
+    alice = _register_ws(instance1, _unique("alice"))
+    room = instance1.post("/api/rooms", json={"name": _unique("general")}).json()
+
+    bob = _register_ws(instance2, _unique("bob"))
+    instance2.post(f"/api/rooms/{room['id']}/join")
+
+    with instance2.websocket_connect("/ws/chat") as bob_ws:
+        bob_ws.send_json({"type": "join", "room_id": room["id"]})
+        assert bob_ws.receive_json()["type"] == "joined"
+
+        resp = instance1.patch("/api/auth/me", json={"display_name": "Alice Updated"})
+        assert resp.status_code == 200, resp.text
+
+        received = bob_ws.receive_json()
+        assert received == {"type": "member_updated", "room_id": room["id"], "user_id": alice["id"]}