Duplicates, delete & storage, users page with J-ID avatars

Backend:
- Perceptual hashes (aHash/dHash/pHash/wHash via imagehash, no imgdd)
  stored on items, computed on upload/download and by the new
  compute_visual_hashes command
- Duplicates API: exact duplicates (multi-location items), visual matches
  for one item, union-find similarity groups with pagination
- Delete API with ownership/staff checks, per-item and per-copy deletion,
  watched-folder path validation; storage overview and temp cleanup;
  file list accepts j_ids batches
- Staged uploads are flagged visual_match with their library matches
  (threshold via VISUAL_MATCH_THRESHOLD)
- Staff users API: list with upload counts, set role and avatar by J-ID;
  User.avatar FK with signed avatar URLs
- Download threads close their DB connection and stale tasks are reaped,
  keeping behaviour Gunicorn-friendly

Frontend:
- /duplicates: exact duplicate groups with per-copy delete, visual
  similarity controls, search similar to a J-ID, paginated groups with
  selection, bulk delete and dismiss
- /delete: storage cards, delete by J-ID with preview grid, temp cleanup
- /users: staff directory with role selects and avatar J-ID inputs
- Nav + command palette entries; top-bar avatar; upload cards and the
  metadata modal show library visual matches

frontend/src/components/AppShell.tsx

@@ -60,7 +60,16 @@ export function AppShell() {
   const navItems = [
     { to: "/", label: "Library" },
     { to: "/online", label: "Online" },
-    ...(user?.can_upload ? [{ to: "/upload", label: "Upload" }] : []),
+    ...(user?.can_upload
+      ? [
+          { to: "/upload", label: "Upload" },
+          { to: "/duplicates", label: "Duplicates" },
+          { to: "/delete", label: "Delete" },
+        ]
+      : []),
+    ...(user && (user.is_staff || user.is_superuser || user.role === "staff")
+      ? [{ to: "/users", label: "Users" }]
+      : []),
   ];
 
   const navigationType = useNavigationType();
@@ -120,9 +129,17 @@ export function AppShell() {
                   title="Account settings"
                   className="flex items-center gap-2 transition hover:opacity-80"
                 >
-                  <span className="flex h-7 w-7 items-center justify-center rounded-full bg-ctp-surface1 font-mono text-xs font-semibold text-ctp-lavender">
-                    {user.username.slice(0, 1).toUpperCase()}
-                  </span>
+                  {user.avatar_url ? (
+                    <img
+                      src={user.avatar_url}
+                      alt={user.username}
+                      className="h-7 w-7 rounded-full border border-ctp-surface1 object-cover"
+                    />
+                  ) : (
+                    <span className="flex h-7 w-7 items-center justify-center rounded-full bg-ctp-surface1 font-mono text-xs font-semibold text-ctp-lavender">
+                      {user.username.slice(0, 1).toUpperCase()}
+                    </span>
+                  )}
                   <span className="hidden text-sm text-ctp-subtext1 sm:block">
                     {user.username}
                   </span>