Add roaster (machine) management, mobile header-tools redesign, and profile pictures

Machines:
- roasters table + actual_roasts.roaster_id (migrations 009): per-user
  machines with a default; uploads attach to the default roaster and are
  reassignable from the roast detail view
- Learning is now per machine: /api/roaster-profile scopes to a roaster
  (default when unspecified) and applies the user's override tweaks
  (milestone temps, TP time, pace factor) on top of learned medians
- /roasters page: machine list + analysis report showing learned vs
  applied values with editable tweaks, typical RoR, and a plain-language
  list of the adjustments applied to plans; planner honors a manual pace
  override; evaluations use the roast's own machine profile

Mobile header redesign:
- The planner's header tools collapse behind a single 'Tools ▾'
  disclosure (dropdown card) at ≤720px, keeping the fixed three-row
  mobile header with no wrapped or scrolling button rows; desktop
  renders inline via display:contents (same DOM, same handlers)

Profile pictures:
- users.avatar (migration 010) + PUT/GET/DELETE /api/account/avatar;
  client-side centre-crop resize to 128px JPEG; avatar shows in the nav
  chip on every page; included in full backups

Co-Authored-By: Claude Fable 5 <[email protected]>

public/account.html

@@ -65,6 +65,29 @@
               <h2>Profile</h2>
             </div>
             <div class="panel-body">
+              <div style="display:flex;align-items:center;gap:14px;margin-bottom:8px">
+                <div
+                  class="nav-user-avatar"
+                  id="profile-avatar"
+                  style="width:64px;height:64px;font-size:24px;flex:none"
+                  aria-hidden="true"
+                ></div>
+                <div style="display:flex;gap:8px;flex-wrap:wrap">
+                  <label class="filebtn ghost-btn small"
+                    >Upload picture…<input
+                      type="file"
+                      id="avatar-file"
+                      accept="image/png,image/jpeg,image/webp"
+                  /></label>
+                  <button
+                    class="ghost-btn small hidden"
+                    type="button"
+                    id="avatar-remove"
+                  >
+                    Remove
+                  </button>
+                </div>
+              </div>
               <p>
                 <strong id="profile-email"></strong>
                 <span class="badge badge-admin hidden" id="profile-role-admin"