Account avatars use a malformed hostname with the backend URL shipped in the plist

## Problem

`avatar(at:)` concatenates `baseURL.absoluteString + path.dropFirst()`. The shipped backend URL has no trailing slash, so an avatar path is appended to the hostname instead of the path. Avatar fetches fail although the other API methods use proper URL path composition.

## Evidence

Reviewed `main` at `8d93f5b8574f3c7b8c30086d9c817bf7f5d4827d`. Reproduced against the unchanged production source in an isolated Swift package on macOS, with fake transport or temporary stores as appropriate. These checks assert the observed defect; they are not a claim that the full app test suite passed.

Using a fake transport, base URL `https://api.example.com`, a valid test session response, and `avatar(at: "/v1/me/avatar")`, the actual requested URL is:

```text
https://api.example.comv1/me/avatar
```

Expected: `https://api.example.com/v1/me/avatar`. No network request was made in the reproduction. `Resources/Uttrflow-Info.plist` likewise configures its backend without a trailing slash.

## Relevant code

- [Sources/UttrflowAccount/HTTPAuthenticationService.swift:303](https://github.com/uttrflow/uttrflow-swift/blob/8d93f5b8574f3c7b8c30086d9c817bf7f5d4827d/Sources/UttrflowAccount/HTTPAuthenticationService.swift#L303)
- [Resources/Uttrflow-Info.plist:15](https://github.com/uttrflow/uttrflow-swift/blob/8d93f5b8574f3c7b8c30086d9c817bf7f5d4827d/Resources/Uttrflow-Info.plist#L15)
- [Sources/Uttrflow/Onboarding/OnboardingAccountLayer.swift:24](https://github.com/uttrflow/uttrflow-swift/blob/8d93f5b8574f3c7b8c30086d9c817bf7f5d4827d/Sources/Uttrflow/Onboarding/OnboardingAccountLayer.swift#L24)

## Fix and acceptance criteria

Compose and validate the avatar URL with URL components rather than string concatenation. Tests should assert the host and path for the actual no-trailing-slash configuration, a trailing slash, and the intended semantics of a base URL containing a path. Keep the existing rejection of external avatar addresses.

Start in Sources/UttrflowAccount/HTTPAuthenticationService.swift at avatar(at:) and inspect Resources/Uttrflow-Info.plist for the no-trailing-slash backend URL. Verify URL construction for no-trailing-slash, trailing-slash, and base URLs with paths, while preserving rejection of external avatar addresses; completion is demonstrated by tests asserting the resulting host and path.

Written by the indexing model from the issue text.