Add user profile management: display name + avatar upload (Gitea issue #12)

Users can set a display name (shown instead of username in the message
list, room member list, TopBar, and admin Users tab) and upload a real
avatar, replacing the generated color-initial avatars everywhere a user
appears. Avatars are square-cropped and downscaled to 512px, reusing
app/storage.py's upload primitives from image uploads with a new square
option.

Two deliberate divergences from message-image handling, documented in
backend/README.md: the previous avatar file is deleted on replace/remove
(safe since it's strictly one file per user), and avatar serving is not
room-gated and uses a short cache (identity-addressed and mutable, unlike
a message image's permanent content-addressed URL).

Frontend: new ProfileModal reachable from the TopBar account menu;
AuthContext gains updateUser() so a profile change reflects instantly
everywhere without a refetch.

backend/app/routers/users.py

@@ -0,0 +1,34 @@
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import FileResponse
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import get_current_user
+from app.models import User
+from app.storage import UPLOADS_DIR
+
+router = APIRouter(prefix="/api/users", tags=["users"])
+
+
+@router.get("/{user_id}/avatar")
+async def get_user_avatar_endpoint(
+    user_id: uuid.UUID,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    user = await db.get(User, user_id)
+    if user is None or not user.avatar_filename:
+        raise HTTPException(status_code=404, detail="No avatar set")
+    return FileResponse(
+        UPLOADS_DIR / user.avatar_filename,
+        media_type=user.avatar_content_type,
+        # Unlike message images (content-addressed, immutable once posted),
+        # an avatar URL is identity-addressed and its content can change on
+        # re-upload -- a short cache instead of `immutable` so a stale copy
+        # doesn't linger. Not room-membership-gated: avatar visibility
+        # matches username visibility (anyone logged in), unlike room-scoped
+        # message content.
+        headers={"Cache-Control": "private, max-age=300"},
+    )