feat(profile): add round avatar with upload and cropping

- backend: user_avatar_objects binding (PG+SQLite), GC preserves avatar blobs,
  avatar service (EXIF-stripping WebP 128/512), public avatar read route
- web: avatar upload/crop on profile, round avatar in header/members/comments/author
- android: avatar upload/crop, round avatar on profile and albums header
- openspec: add-user-avatar proposal/design/specs/tasks

backend/internal/auth/sqlite_store.go

@@ -88,6 +88,13 @@ func (s *SQLiteStore) UpdatePreferences(ctx context.Context, userID string, raw
 		`UPDATE users SET preferences = $2 WHERE id = $1`, userID, string(raw)))
 }
 
+// SetAvatarURL stores the stable URL of the user's avatar. An empty value
+// clears the column.
+func (s *SQLiteStore) SetAvatarURL(ctx context.Context, userID, url string) error {
+	return s.requireRow(s.db.ExecContext(ctx,
+		`UPDATE users SET avatar_url = NULLIF($2, '') WHERE id = $1`, userID, url))
+}
+
 func (s *SQLiteStore) requireRow(res sql.Result, err error) error {
 	if err != nil {
 		return err