feat: profile avatar + tombstone-restore fix + WebView2 nav race + sync summary

Profile picture / avatar
- users.avatar_b64 column (nullable, cosmetic, not encrypted) + GET/POST
  /avatar endpoints mirroring the settings handler pattern.
- Top-right chip + Settings→Account show a round avatar: custom picture
  if set, otherwise the username's initial on a deterministic
  hash-picked colour (stable across renders).
- Upload downscales + center-crops to a 128px JPEG via FileReader →
  data: URI (NOT blob:, which the CSP's `img-src 'self' data:` blocks)
  before POSTing. Remove button clears it.
- Carried in the encrypted JSON export; restored on import only when the
  current account has no picture (never clobbers a local one).

Tombstone restore-then-sync fix
- POST /entries and POST /entries/bulk-import now DELETE any tombstone
  matching an inserted uuid (same transaction) so a restored backup
  isn't re-killed on the next sync by its own stale tombstone.
- applyRemoteSnapshot arbitrates remote tombstones by timestamp: a
  tombstone is skipped when the local entry with that uuid is newer than
  deleted_at (resurrection wins). Ties / unparseable timestamps favour
  KEEP. loadEntries() up front so updated_at reflects the live rows.

WebView2 navigation race
- Black-window-on-cold-start fix: the 1.5s nav timer no longer consumes
  FPendingURL when WebView2 isn't initialised yet (it re-arms, bounded
  to ~10 retries). FBrowserInitialized flag set in OnInitialized; after
  the retry budget we Navigate best-effort rather than loop forever.

Sync UX
- Bidirectional toast: "pulled X new · Y updated · Z deleted · pushed N
  entries" so a 0/0/0 pull still shows the vault was uploaded.
- FolderPOST/PUT: pre-declare ftString on color/icon params (fixes the
  earlier [SQLite]-335 on NULL bind, already in play for CSV import).

Docs
- CLAUDE.md sync section documents tombstone purge-on-insert +
  resurrection arbitration.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

index.html

@@ -350,6 +350,7 @@
                 </div>
                 <div class="user-menu">
                     <button class="user-chip" id="userChip">
+                        <span class="user-avatar" id="userAvatar"></span>
                         <span id="userName">user</span>
                     </button>
                     <div class="user-dropdown is-hidden" id="userDropdown">
@@ -770,9 +771,23 @@
 
             <div class="slideover-field">
                 <div class="slideover-field-label">Account</div>
-                <p style="font-size:12px;color:var(--text-dim);margin:0 0 4px">
-                    Signed in as <b id="settingUser"></b>
-                </p>
+                <div style="display:flex;align-items:center;gap:12px;margin:0 0 10px">
+                    <span class="user-avatar user-avatar-lg" id="settingAvatarPreview"></span>
+                    <div style="display:flex;flex-direction:column;gap:4px">
+                        <p style="font-size:12px;color:var(--text-dim);margin:0">
+                            Signed in as <b id="settingUser"></b>
+                        </p>
+                        <div style="display:flex;gap:6px">
+                            <button class="btn btn-ghost btn-sm" id="settingAvatarUpload">
+                                <svg><use href="#i-user"/></svg> Change picture
+                            </button>
+                            <button class="btn btn-ghost btn-sm" id="settingAvatarRemove" style="display:none;color:var(--danger)">
+                                Remove
+                            </button>
+                        </div>
+                        <input type="file" id="settingAvatarInput" accept="image/*" style="display:none">
+                    </div>
+                </div>
                 <p style="font-size:11px;color:var(--text-faint);margin:0 0 8px" id="settingVersionRow">
                     PMServer <span id="settingVersion">—</span>
                 </p>