A member's avatar comes from their Supabase user_metadata, which they can
edit, and every teammate's app fetches it with no click: in the presence
row and in the owner's share dialog. Any address there let one member make
the others' apps request a URL of their choosing, revealing their IP or
poking hosts on their network.

The server now passes on an avatar only when it is the kind Supabase writes
for a Discord sign-in (https://cdn.discordapp.com/avatars/... or
/embed/avatars/...): in profileFromIdentity, so in new presence passes and
users rows, and when presence and shares.listMembers read a stored avatar,
so rows written before need no backfill. Anything else goes as null, which
every build already draws as the initial-letter fallback.