feat(cabana): add backend user avatars to My account and the top bar

- cabana.BackendUser is an attach.Owner (MorphName Backend\Models\User,
  cabana.BackendUserMorphType) with one public attachOne avatar
  (cabana.BackendUserAvatarField), as WinterCMS stores it
- POST /account/avatar stores one file_data image (jpg, jpeg, png, gif or
  webp, image guard, at most cabana.AvatarMaxBytes = 2 MiB, under a
  server-generated name) and replaces the previous avatar: old rows are
  deleted in the transaction, their blobs after the commit
- DELETE /account/avatar removes the avatar and is idempotent
- GET /auth/me and the account routes return avatar {url, thumb_url}
  (250x250 crop); cabana.BackendUserAvatar lets plugins read it
- swag annotations, regenerated admin.json and schema.d.ts; route
  inventories, CSRF walk (29) and OpenAPI conformance learn both routes
- SPA: avatar upload and remove on My account, avatar image in the user
  menu trigger and header; backend::lang.myaccount avatar strings
- rebuilt boardwalk dist; cabana README, users-and-permissions and
  admin-spa docs

modules/phrasebook/backend/lang/en/lang.yaml

@@ -248,3 +248,10 @@ myaccount:
   field_not_editable: This field cannot be changed on My account.
   subtitle_unavailable: The subtitle cannot be saved because the stored profile metadata is not a JSON object.
   saved: Account saved
+  avatar: Avatar
+  avatar_upload: Upload picture
+  avatar_remove: Remove picture
+  avatar_remove_confirm: Remove your avatar?
+  avatar_hint: JPG, PNG, GIF or WebP, up to 2 MB.
+  avatar_saved: Avatar saved
+  avatar_removed: Avatar removed

modules/phrasebook/backend/lang/pl/lang.yaml

@@ -270,3 +270,10 @@ myaccount:
   field_not_editable: Tego pola nie można zmienić w ustawieniach konta.
   subtitle_unavailable: Nie można zapisać podtytułu, ponieważ zapisane metadane profilu nie są obiektem JSON.
   saved: Zapisano konto
+  avatar: Awatar
+  avatar_upload: Wgraj zdjęcie
+  avatar_remove: Usuń zdjęcie
+  avatar_remove_confirm: Usunąć awatar?
+  avatar_hint: JPG, PNG, GIF lub WebP, maksymalnie 2 MB.
+  avatar_saved: Zapisano awatar
+  avatar_removed: Usunięto awatar