Self-service avatar picker in Account

Users can now set their own profile picture instead of asking staff:
POST /api/auth/avatar/ accepts a J-ID (or blank to clear) and reuses the
same item resolution as the staff endpoint. The Account page gains a
profile picture card with a searchable, paginated library grid — any
item works (the thumbnail is used), the current avatar is marked, and
the choice is confirmed before saving. Refreshing the signed-in user
updates the shell avatar immediately.

Verified against the dev server: set, clear, unknown J-ID -> 400,
anonymous -> 401.

backend/apps/accounts/urls.py

@@ -1,12 +1,13 @@
 from django.urls import path
 from rest_framework.authtoken.views import obtain_auth_token
 
-from .views import E621CredentialsView, LogoutView, MeView, RegisterView
+from .views import AvatarView, E621CredentialsView, LogoutView, MeView, RegisterView
 
 urlpatterns = [
     path("register/", RegisterView.as_view(), name="register"),
     path("token/", obtain_auth_token, name="login"),
     path("logout/", LogoutView.as_view(), name="logout"),
     path("me/", MeView.as_view(), name="me"),
+    path("avatar/", AvatarView.as_view(), name="avatar"),
     path("e621/", E621CredentialsView.as_view(), name="e621_credentials"),
 ]