refactor(avatars): make avatars a plain resource pointer, not a pinned signature

[QuickMythril]

Summary

• replace signature-pinned account and group avatars with a plain QDN resource pointer: service, registered name, and optional identifier
• resolve the latest target revision at serve time, allow pointers to any registered name, and keep the target existence-independent at assignment time
• retain the height-70000 activation and setter authorization while enforcing raster type and the 500 KiB bound when serving
• harden UTF-8 wire-length validation, reject unknown serialized service IDs cleanly, and repair group rollback reference traversal
• update database schemas, transaction transforms, API metadata, tests, and the superseding changelog entry

Validation

• focused avatar, repository, JSON, serialization, rollback, and chain-config gate: 58 tests; 0 failures; 0 errors
• complete Maven suite: 2792 tests; 0 failures; 0 errors; 64 skipped
• git diff --check passed