Add user profile management: display name + avatar upload (Gitea issue #12)

Users can set a display name (shown instead of username in the message
list, room member list, TopBar, and admin Users tab) and upload a real
avatar, replacing the generated color-initial avatars everywhere a user
appears. Avatars are square-cropped and downscaled to 512px, reusing
app/storage.py's upload primitives from image uploads with a new square
option.

Two deliberate divergences from message-image handling, documented in
backend/README.md: the previous avatar file is deleted on replace/remove
(safe since it's strictly one file per user), and avatar serving is not
room-gated and uses a short cache (identity-addressed and mutable, unlike
a message image's permanent content-addressed URL).

Frontend: new ProfileModal reachable from the TopBar account menu;
AuthContext gains updateUser() so a profile change reflects instantly
everywhere without a refetch.

frontend/src/components/RoomInfoPanel.tsx

@@ -1,6 +1,7 @@
 import { useEffect, useState, type FormEvent } from 'react'
 import { ApiError } from '../api/client'
 import { createInvite, listRoomInvites, revokeInvite } from '../api/invites'
+import { getUserAvatarUrl } from '../api/users'
 import {
   changeMemberRole,
   deleteRoom,
@@ -230,8 +231,13 @@ export function RoomInfoPanel({
         <div className="room-info-label">Members</div>
         {members.map((m, i) => (
           <div key={m.user_id} className="room-info-member-row">
-            <UserAvatar username={m.username} colorIndex={i} size={24} />
-            <span className="room-info-member-name">{m.username}</span>
+            <UserAvatar
+              username={m.username}
+              colorIndex={i}
+              size={24}
+              avatarUrl={m.avatar_filename ? getUserAvatarUrl(m.user_id, m.avatar_filename) : null}
+            />
+            <span className="room-info-member-name">{m.display_name || m.username}</span>
             <span className={`role-badge role-badge-${m.role}`}>{m.role}</span>
             {myRole === 'owner' && m.user_id !== user?.id && (
               <div className="room-info-member-actions">