feat(engine): wire avatar download and display into profile modal

- Add avatar_plugin: AvatarPlugin, AvatarResource, AvatarFetchEvent
  - After AvatarFetchEvent fires, spawns an async reqwest download task
  - On completion, decodes image bytes via image::load_from_memory →
    Image::from_dynamic and inserts into Assets<Image>
- Expand auth task to also call fetch_me_with_token immediately after
  login/register so avatar_url is available without a second round-trip
- poll_auth_task fires AvatarFetchEvent when avatar_url is Some, building
  the full URL from base_url + relative avatar path
- Profile modal shows 48px circular avatar ImageNode when AvatarResource
  is populated, or an initials disc (first letter of username) as fallback
- Add image = "0.25" and reqwest to solitaire_engine deps
- Add fetch_me_with_token helper to SolitaireServerClient for use when
  the access token hasn't been persisted to keychain yet

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_data/src/sync_client.rs

@@ -534,6 +534,21 @@ impl SolitaireServerClient {
         Self::extract_me_body(resp).await
     }
 
+    /// Like [`fetch_me`] but uses an explicit token instead of reading from the
+    /// OS keychain. Useful immediately after login/register when the token has
+    /// not yet been persisted.
+    pub async fn fetch_me_with_token(&self, token: &str) -> Result<(String, Option<String>), SyncError> {
+        let url = format!("{}/api/me", self.base_url);
+        let resp = self
+            .client
+            .get(&url)
+            .bearer_auth(token)
+            .send()
+            .await
+            .map_err(|e| SyncError::Network(e.to_string()))?;
+        Self::extract_me_body(resp).await
+    }
+
     async fn extract_me_body(resp: reqwest::Response) -> Result<(String, Option<String>), SyncError> {
         let status = resp.status();
         if !status.is_success() {