Model pictures: a model's own image, read through the bridge as a data: URL

/api/v2/models names each model's picture (image, readable with the app's
token at /api/v2/models/images/<file>). A command reads it in Rust -- one
plain file name on the app's door, one of the four types the server accepts,
at most its 2 MB -- and hands the page a data: URL, which its policy already
allows. The avatar shows it once it arrives; the coloured initial stays for a
model without one and until then.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ui/app.css

@@ -449,6 +449,9 @@ label, .label { font: var(--text-sm) / var(--leading-tight) var(--font-ui); colo
   flex: none;
 }
 .avatar--none { background: var(--surface-active); }
+/* A model's own picture fills the same square, cut to it: the avatar's size does not depend on it. */
+.avatar--image { overflow: hidden; background: var(--surface); }
+.avatar--image img { display: block; width: 100%; height: 100%; object-fit: cover; }
 /* The model picker: a button the height of a control, avatar · name · chevron. */
 .picker {
   display: inline-grid;