fix(avatars): every signed-in account sees other users' pictures

System Health shows every user's name and avatarAt to everyone, but the
picture route GET /api/users/:id/avatar sat under the staff-only /users
prefix, so a developer got 403 EADMIN and saw only initials. authGuard now
lets any signed-in account make that one read (EVERYONE_READS); every
other /users path stays staff-only, and the test checks both.

server/openapi-extra/auth.js

@@ -21,7 +21,7 @@
  *   - POST /api/me/avatar/url (Auth) — the picture as a link, redirected to
  *   - GET/PATCH /api/users/{id} (Auth) — the Users page's Edit user form (its `quota` too)
  *   - PUT /api/users/quota-default, GET /api/me/quota (Auth) — spend quotas per user
- *   - GET /api/users/{id}/avatar (Auth) — one account's picture (admin/analyst)
+ *   - GET /api/users/{id}/avatar (Auth) — one account's picture (every account)
  *   - GET /api/users/tmux, POST /api/users/{id}/tmux-restart, POST /api/users/tmux-restart-idle
  *     (Auth) — each member's own tmux server and an admin's restart of it (S3)
  * Exports `{ tags, schemas, paths }`, combined into the spec by
@@ -731,12 +731,11 @@ const paths = {
     get: {
       tags: ["Auth"],
       operationId: "getUserAvatar",
-      summary: "One account's picture, for the sidebar's owner groups (admin/analyst)",
+      summary: "One account's picture, for owner groups and System Health (every signed-in account)",
       parameters: [{ name: "id", in: "path", required: true, schema: { type: "integer" } }],
       responses: {
         200: { description: "The image (PNG, JPEG, GIF or WebP)" },
         302: { description: "Redirect to that account's avatar link" },
-        403: err("EADMIN — a developer"),
         404: err("ENOAVATAR"),
       },
     },