Add user profile management: display name + avatar upload (Gitea issue #12)

Users can set a display name (shown instead of username in the message
list, room member list, TopBar, and admin Users tab) and upload a real
avatar, replacing the generated color-initial avatars everywhere a user
appears. Avatars are square-cropped and downscaled to 512px, reusing
app/storage.py's upload primitives from image uploads with a new square
option.

Two deliberate divergences from message-image handling, documented in
backend/README.md: the previous avatar file is deleted on replace/remove
(safe since it's strictly one file per user), and avatar serving is not
room-gated and uses a short cache (identity-addressed and mutable, unlike
a message image's permanent content-addressed URL).

Frontend: new ProfileModal reachable from the TopBar account menu;
AuthContext gains updateUser() so a profile change reflects instantly
everywhere without a refetch.

frontend/src/api/auth.ts

@@ -1,4 +1,4 @@
-import { apiFetch } from './client'
+import { apiFetch, ApiError, NetworkError } from './client'
 import type { User } from '../types'
 
 // No register() here: this is an invite-only site. Accounts are created by
@@ -19,3 +19,46 @@ export function logout(): Promise<void> {
 export function me(): Promise<User> {
   return apiFetch<User>('/api/auth/me')
 }
+
+export function updateProfile(displayName: string | null): Promise<User> {
+  return apiFetch<User>('/api/auth/me', {
+    method: 'PATCH',
+    body: JSON.stringify({ display_name: displayName }),
+  })
+}
+
+export function removeAvatar(): Promise<User> {
+  return apiFetch<User>('/api/auth/me/avatar', { method: 'DELETE' })
+}
+
+// Not apiFetch: that wrapper always sets Content-Type: application/json,
+// which would stomp the multipart boundary the browser needs to set itself
+// for a file upload. Mirrors api/rooms.ts's uploadRoomImage.
+export async function uploadAvatar(file: File): Promise<User> {
+  const formData = new FormData()
+  formData.append('file', file)
+
+  let response: Response
+  try {
+    response = await fetch('/api/auth/me/avatar', {
+      method: 'POST',
+      credentials: 'include',
+      body: formData,
+    })
+  } catch {
+    throw new NetworkError()
+  }
+
+  if (!response.ok) {
+    let detail = response.statusText
+    try {
+      const body = await response.json()
+      detail = body.detail ?? detail
+    } catch {
+      // response had no JSON body
+    }
+    throw new ApiError(response.status, detail)
+  }
+
+  return (await response.json()) as User
+}