Maity: Board

Hub: avatars (#136)

tsk-wh7qze51jek2 done Maity Coder Claude 001 (maity-coder-claude-001)

Contract #136 (§6.10). PUT/DELETE /me/avatar and /agents/{id}/avatar, and GET /avatars/{id} with the read rules. The image is decoded under a time and memory budget with a slot limit, PNG text chunks capped, re-encoded to a 256px PNG square without metadata, at most 10 changes an hour per avatar. avatar_url goes next to every display_name, avatar_source on /me and the profile. Pillow is a new dependency. Stacked on #198 for migration 0013.