1.0 shell: one window with a party strip; protocol 9 profile + avatars by hash

The shell (lib/src/shell/) replaces the Home and session screens:
- Party strip: profile, Library / Schedule / Settings tabs, Join and
  Host cards (hosting no longer takes media), status-ring avatar stack
  with the member list, chat & activity panel, Leave.
- The real session player is mounted once and shown full, as a
  draggable corner-snapping mini player, or fullscreen (window_manager,
  party and toasts overlaid); the Video is never mounted twice.
- Profile popover with inline rename, colour and a crop picker (256 px
  PNG), pushed live to the session; avatar toasts; waiting pill.
- Motion kit (fastEaseInToSlowEaseOut, fade-through, popovers,
  mouse-drag/wheel horizontal scrolling).
- Library = the existing picker for now (restyled next round); Schedule
  = the new SchedulePage; Settings = left nav over the existing panels.

Protocol 9 (packages/core, packages/server, sync client):
- {"t":"profile"} renames / changes the picture mid-session ("rename",
  "avatar" feed actions); names are cleaned the same way at hello.
- state.members carry avatarHash; pictures are served once from
  /a/<sid>/<token>/<hash> (PNG/JPEG/WebP/GIF by magic bytes only) and
  cached by hash in the app (AvatarCache).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/desktop/test/avatar_cache_test.dart

@@ -0,0 +1,59 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:sync_relay_core/core.dart';
+import 'package:sync_relay_server/server.dart';
+import 'package:watch_together/src/sync/avatar_cache.dart';
+import 'package:watch_together/src/sync/sync_client.dart';
+
+Future<void> _poll(FutureOr<bool> Function() cond, String what) async {
+  final deadline = DateTime.now().add(const Duration(seconds: 10));
+  while (DateTime.now().isBefore(deadline)) {
+    if (await cond()) return;
+    await Future.delayed(const Duration(milliseconds: 50));
+  }
+  fail('timed out waiting for $what');
+}
+
+void main() {
+  test('pictures arrive by hash over /a/; profile renames and swaps them', () async {
+    final server = SyncServer(const AppConfig(port: 0, secret: 's', name: 'avatars'));
+    await server.start();
+    final client = SyncClient();
+    final cache = AvatarCache(client);
+    var notified = 0;
+    cache.addListener(() => notified++);
+    final first = Uint8List.fromList([0x89, 0x50, 0x4E, 0x47, ...List<int>.generate(196, (i) => i % 256)]);
+    final second = Uint8List.fromList([0xFF, 0xD8, 0xFF, ...List<int>.generate(197, (i) => 255 - i % 256)]);
+    try {
+      await client.connect(
+        wsUri: Uri.parse('ws://127.0.0.1:${server.boundPort}/sync'),
+        secret: 's',
+        name: 'alice',
+        avatar: base64Encode(first),
+      );
+      final hash = avatarHashOf(first);
+      expect(client.lastState!.members.single.avatarHash, hash);
+      await _poll(() => cache.bytesFor(hash) != null, 'first picture');
+      expect(cache.bytesFor(hash), first);
+      expect(notified, 1);
+
+      client.sendProfile(name: 'bob', avatar: base64Encode(second));
+      await _poll(() => client.lastState?.members.single.name == 'bob', 'rename');
+      final next = client.lastState!.members.single.avatarHash;
+      expect(next, avatarHashOf(second));
+      await _poll(() => cache.bytesFor(next) != null, 'second picture');
+      expect(cache.bytesFor(hash), first, reason: 'earlier pictures stay cached');
+
+      client.sendProfile(avatar: '');
+      await _poll(() => client.lastState?.members.single.avatarHash == '', 'picture removed');
+      expect(cache.bytesFor(''), isNull);
+    } finally {
+      cache.dispose();
+      await client.dispose();
+      await server.stop();
+    }
+  });
+}