Load sender avatars from GNOME Contacts - #8

Summary

• resolve sender avatars in this order: local EDS/vCard PHOTO → opt-in Gravatar → coloured initials
• support Nextcloud data-URI PHOTO, standard folded ENCODING=b, grouped properties and safe EDS file:// photos
• index local/CardDAV photo locations in the background and refresh visible avatars when EDS changes without jumping the message list scroll position
• try all duplicate contact candidates and preserve cache provenance so disabling Gravatar immediately hides cached Gravatars
• correlate asynchronous results by sender and EDS generation to prevent wrong/stale avatars
• coalesce duplicate Gravatar lookups, cap concurrency, apply timeouts/backoff, and cache only definitive 404 misses
• reject remote vCard PHOTO URLs and SVG; decode/downscale raster photos off the GTK thread and create bounded 160px textures on the main thread

Privacy

• local contact photos require no additional CardDAV/network request
• Gravatar remains opt-in and is queried only when no usable local photo exists
• remote PHOTO URLs are never fetched
• local file URIs are canonicalized and restricted to EDS address-book directories

Testing

• cargo check --locked
• cargo test --locked — 48 passed
• cargo clippy --all-targets --locked — passes; pre-existing style warnings remain
• combined GOA + avatar build: 57 passed
• live EDS/Nextcloud cache indexed 399 sender-photo addresses
• verified and decoded the local vCard PNG for schavelevoi@basealt.ru
• multiple independent Codex and Claude review rounds completed and findings addressed