feat: profile avatar + tombstone-restore fix + WebView2 nav race + sync summary

Profile picture / avatar
- users.avatar_b64 column (nullable, cosmetic, not encrypted) + GET/POST
  /avatar endpoints mirroring the settings handler pattern.
- Top-right chip + Settings→Account show a round avatar: custom picture
  if set, otherwise the username's initial on a deterministic
  hash-picked colour (stable across renders).
- Upload downscales + center-crops to a 128px JPEG via FileReader →
  data: URI (NOT blob:, which the CSP's `img-src 'self' data:` blocks)
  before POSTing. Remove button clears it.
- Carried in the encrypted JSON export; restored on import only when the
  current account has no picture (never clobbers a local one).

Tombstone restore-then-sync fix
- POST /entries and POST /entries/bulk-import now DELETE any tombstone
  matching an inserted uuid (same transaction) so a restored backup
  isn't re-killed on the next sync by its own stale tombstone.
- applyRemoteSnapshot arbitrates remote tombstones by timestamp: a
  tombstone is skipped when the local entry with that uuid is newer than
  deleted_at (resurrection wins). Ties / unparseable timestamps favour
  KEEP. loadEntries() up front so updated_at reflects the live rows.

WebView2 navigation race
- Black-window-on-cold-start fix: the 1.5s nav timer no longer consumes
  FPendingURL when WebView2 isn't initialised yet (it re-arms, bounded
  to ~10 retries). FBrowserInitialized flag set in OnInitialized; after
  the retry budget we Navigate best-effort rather than loop forever.

Sync UX
- Bidirectional toast: "pulled X new · Y updated · Z deleted · pushed N
  entries" so a 0/0/0 pull still shows the vault was uploaded.
- FolderPOST/PUT: pre-declare ftString on color/icon params (fixes the
  earlier [SQLite]-335 on NULL bind, already in play for CSV import).

Docs
- CLAUDE.md sync section documents tombstone purge-on-insert +
  resurrection arbitration.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

css/style.css

@@ -751,6 +751,27 @@ input[type="range"]::-webkit-slider-thumb {
     transition: all var(--t-fast);
 }
 .user-chip:hover { background: var(--bg-elev-2); }
+/* Round initials avatar. Background colour is set inline from a hash of
+   the username (deterministic — same user, same colour every render).
+   Falls back to a background-image when a custom picture is set. */
+.user-avatar {
+    display: inline-flex; align-items: center; justify-content: center;
+    width: 22px; height: 22px;
+    margin-left: -4px;
+    border-radius: 50%;
+    font-size: 11px; font-weight: 600;
+    color: #fff;
+    text-transform: uppercase;
+    background-size: cover; background-position: center;
+    flex-shrink: 0;
+    user-select: none;
+}
+/* Larger preview variant shown in Settings → Account. */
+.user-avatar-lg {
+    width: 48px; height: 48px;
+    margin-left: 0;
+    font-size: 20px;
+}
 .user-dropdown {
     position: absolute; top: calc(100% + 6px); right: 0;
     min-width: 180px;