feat(backend): serve avatars through accounts-service behind the gateway

accounts-service returned avatar_url built from the internal S3_ENDPOINT
(http://minio:9000/<bucket>), which browsers cannot resolve, so avatars never
rendered and the re-crop fetch failed. MinIO is intentionally not exposed.

Add a public GET /media/{key} read route in accounts-service (behind the
gateway internal-key guard, no identity required so anonymous profile pages
work) that streams the object out of private MinIO. Introduce
AVATAR_PUBLIC_BASE_URL so the browser-facing prefix is decoupled from the
internal endpoint; prod sets it to the same-origin /api/media, gateway routes
the media segment to accounts.

backend/accounts-service/src/lib.rs

@@ -58,6 +58,9 @@ pub fn build_app(pool: sqlx::PgPool, cfg: &Config) -> Router {
 
     let avatar_routes = Router::new()
         .route("/avatars", post(avatars::handlers::upload))
+        // Public avatar read served back through the gateway; the `{*key}`
+        // wildcard is the storage key (`avatars/<uuid>.png`).
+        .route("/media/{*key}", get(avatars::handlers::serve))
         // Hard transport cap slightly above the 5 MB business limit (413 beyond it).
         .layer(DefaultBodyLimit::max(6 * 1024 * 1024))
         .with_state(avatar_state);