feat: add profile pictures

[aniemerg]

Summary

• add workspace-scoped profile avatar storage metadata and avatar upload/delete/serve routes
• normalize uploaded images to 256px WebP via sharp and serve through authenticated avatar URLs
• extend UserRef with optional avatar fields and render avatars across settings, sidebar, presence, mentions, messages, threads, and member lists

Validation

• node surface/server/scripts/check-migration-filenames.mjs
• git diff --check
• Not run: pnpm lint, focused server tests, typecheck. The sandbox registry policy returns 403 Forbidden for https://registry.npmjs.org/pnpm, and no local node_modules/biome/vitest/tsc binaries are installed.

Prompted by: Allan Niemerg (@allan)

[github-actions]

Thank you for your contribution! Before we can accept it, we ask that you sign our Contributor License Agreement. You can sign by posting the comment below. If you are contributing on behalf of your employer, your employer may also need to sign the Corporate CLA — see that document for how.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}