Staff avatars from Steam, cached in memory

The public staff page, the staff panel's staff list and the signed-in badge show each member's
Steam avatar over their initial. The panel fetches it from the profile XML (no Web API key),
keeps it in memory for a day (failures for an hour, one shared fetch per player) and serves it
from /avatar/<steamid> with a day's browser caching, so the CSP stays img-src 'self' and
visitors never contact Steam. Only SimpleAdmin admins are served; anything else falls back to the
initial.

internal/web/assets/public.js

@@ -161,7 +161,7 @@ async function staff() {
       <ul class="crew">
         ${g.members.map((p) => `<li>
           <a href="${steamProfile(p.steamid)}" target="_blank" rel="noopener">
-            <span class="avatar">${initial(p.name)}</span>
+            ${avatar(p.steamid, p.name)}
             <span><b>${esc(p.name)}</b><small>${p.online ? '<span class="dot"></span>On the server' : "Steam profile"}</small></span>
           </a>
         </li>`).join("")}