fix(manage): use Bluesky CDN URL for prefill avatar
The /api/me/avatar proxy occasionally fails to render in the form
slot on first sign-in (broken-image glyph), even though the upstream
PDS getBlob succeeds. Cut out the proxy hop entirely for the prefill
case: build the deterministic public Bluesky CDN URL from the
did + cid we already have. Also add an onError fallback on the form's
avatar <img> so any broken source collapses to the empty placeholder
instead of leaving the browser glyph.
Made-with: Cursor