Part of #2
src-tauri/src/explorer.rs turns a creator's avatar into an absolute https:// address, and frontend/src/avatar.js puts it in an <img>, but img-src in src-tauri/tauri.conf.json allows only 'self' and data:. Read from the code, not seen running: confirm it in the built app first. The account's own avatar is unaffected. A row shows the picture, or the initial where there is none, with the content security policy kept closed to remote origins (ADR 0011).
Confirmed in the built app, then fixed in 4a28463. With the policy as shipped the webview asked for no picture; with
img-srcalone widened it asked for each. The backend now fetches each picture from the index and hands the window adata:URL, and the policy is unchanged.