fix(ui): robust avatars — no-referrer + graceful fallback

Channel/account avatars come from Google's image CDNs (yt3.ggpht.com,
lh3.googleusercontent.com). On a feed page dozens load at once; the CDN
rate-limits the referrer-bearing burst (429), so a random subset rendered the
browser's broken-image icon (the URLs themselves are valid — verified 200).

Add a shared <Avatar> that sets referrerPolicy="no-referrer" (which the CDNs
serve without throttling) and falls back to a neutral initial placeholder on
error instead of the broken-image icon. Use it for video-card, player, channel
manager, header and settings avatars.

frontend/src/components/VideoCard.tsx

@@ -1,4 +1,5 @@
 import { Bookmark, Check, CheckCheck, Eye, EyeOff, ListFilter } from "lucide-react";
+import Avatar from "./Avatar";
 import clsx from "clsx";
 import type { Video } from "../lib/api";
 import { formatDuration, formatViews, relativeTime } from "../lib/format";
@@ -203,14 +204,11 @@ export default function VideoCard({
     >
       <Thumb video={video} className="aspect-video" onOpen={onOpen} />
       <div className="flex gap-3 mt-2.5 px-0.5 pb-0.5">
-        {video.channel_thumbnail && (
-          <img
-            src={video.channel_thumbnail}
-            alt=""
-            loading="lazy"
-            className="w-9 h-9 rounded-full shrink-0 mt-0.5"
-          />
-        )}
+        <Avatar
+          src={video.channel_thumbnail}
+          fallback={video.channel_title ?? ""}
+          className="w-9 h-9 rounded-full shrink-0 mt-0.5"
+        />
         <div className="min-w-0 flex-1">
           {title}
           <a