Add user and team avatar uploads

[yuanzui-cf]

Objective

Allow users and team owners to upload, crop, replace, and remove avatars throughout the Console.

Scope

• Add browser-native square cropping with drag, touch, zoom, and keyboard adjustment.
• Produce PNG crop payloads between 128 and 1024 pixels.
• Validate and encode final images as WebP in the Control API.
• Store immutable avatar objects with backend-neutral derived keys.
• Surface avatar URLs in user and team API views and existing avatar consumers.

Acceptance Criteria

• Users can manage their own avatar from Profile settings.
• Team owners can manage the team avatar from Team settings.
• Very small images are upscaled to at least 128 by 128 and large crops are capped at 1024 by 1024.
• Invalid, oversized, or non-square payloads are rejected.
• Replacing an avatar changes its immutable URL and preserves the previous avatar on failed updates.
• Initials remain the fallback when no image exists or image loading fails.
• Backend and Console tests cover validation, crop math, permissions, and UI states.

Constraints

• Do not add a browser crop dependency.
• Persist only version identifiers and backend-neutral object keys; do not store absolute filesystem paths or public URLs.
• Keep the storage layout ready for a future object-storage backend.