feat(auth): add /api/me endpoint, avatar upload, and profile picture support

- Add migration 005: nullable avatar_url column on users table
- Add GET /api/me: returns id, username, avatar_url from DB (fixes UUID-on-profile bug)
- Add PUT /api/me/avatar: accepts raw image bytes (≤1 MB, jpeg/png/webp/gif),
  writes to avatars/ dir, updates avatar_url in DB
- Serve /avatars via ServeDir so uploaded images are publicly accessible
- Update account.html: fetch username from /api/me instead of parsing JWT;
  add circular avatar display with initials fallback and click-to-upload
- Add SolitaireServerClient::fetch_me() for desktop/Android profile display
- Add avatar_url field to SyncBackend::SolitaireServer settings (serde default None)
- Update sqlx offline query cache for new avatar_url queries

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_engine/src/sync_setup_plugin.rs

@@ -424,6 +424,7 @@ fn poll_auth_task(
             settings.0.sync_backend = SyncBackend::SolitaireServer {
                 url: url.clone(),
                 username: username.clone(),
+                avatar_url: None,
             };
             if let Some(path) = &settings_path.0
                 && let Err(e) = save_settings_to(path, &settings.0)