Import plugin core - #2

## Problem

Buzz mobile saves emoji+color profile avatars as an inline SVG data URL.
It uses the template from the old desktop editor (`emojiAvatarDataUrl`
in block/buzz `mobile/lib/shared/emoji/emoji_avatar.dart`). Here,
`avatarSource` rejects all SVG data, which causes two problems for
anyone who picks an emoji avatar on mobile:

- Desktop shows their initials instead of the avatar.
- Profile Settings shows "Use an HTTPS image URL without credentials…"
and won't save any profile change until the avatar is removed.

The old desktop (block/buzz `desktop/`) rendered these avatars. This
app's `avatarSource` has rejected SVG since
#2.
#2849 added a strict parser for
this template, but only agent import uses it, to convert the avatar to a
PNG.

## Change

- Move that parser (`legacyEmojiPicture`) from
`features/agents/import-picture.ts` into `shared/avatar-source.ts`. The
template is now defined once and used for both parsing and rebuilding.
- `avatarSource` returns that template **rebuilt from the parsed emoji
and color**, never the stored bytes. Arbitrary SVG, script, remote
references and non-hex fills are still rejected, as before.
- `avatarPictureError` accepts the template, so a profile can keep a
mobile emoji avatar when saved from desktop.

Mobile is unchanged. The avatars render as `<img>` data URLs, which the
CSP already allows (`img-src … data:`). That rules out script and remote
fetches.

## Validation

- **New tests fail on `origin/main` and pass here:**
- `src/shared/avatar-source.test.ts`: the exact string mobile produces,
plus a raw-`#` variant that is rebuilt to the canonical form.
- `src/app/ProfileSettings.avatar.test.tsx`: the profile preview shows
the avatar, no alert appears, and the profile saves with the picture
unchanged.
- **New and existing rejection tests still pass**, and the agent-import
PNG conversion tests are unchanged.
- **WebKit (Playwright) renders the rebuilt mobile SVG** at its natural
512px size: an orange circle with a 🛹.
- **`pnpm typecheck` and Biome pass.** Full `vitest run` passed 20,491
tests with 4 failures. The failures were in `codex-sh.test.ts` and
`MediaDownloadAction.test.tsx`, which this change doesn't touch, and
both files pass when rerun alone.
- **Not yet done:** an agent run of the native app, and human testing.

## Known limitation (out of scope)

The shared `AvatarEditor` URL field now also accepts this template for
agents. The native agent controller still requires HTTPS, so if someone
pastes one of these SVG data URLs into an agent's picture URL, the save
fails with the same HTTPS message.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Matt Toohey <[email protected]>
Co-authored-by: Jitter <2b2e6415e748c35180847a37aadae06a11e30dddc76b784e7fd9354c4eb42e7a@buzz.block.builderlab.xyz>
Co-authored-by: Claude Opus 5.5 <[email protected]>