List Shop Avatars

Signed avatar URLs for everyone in the caller's shop, as id triples.

THE POINT OF THIS ENDPOINT is that avatarUrl does not have to be bolted onto every payload that happens to show a face. Projects, tasks, comments and mentions all render people; growing each of those responses a picture field would be six ways to fetch the same fact, drifting apart. The client fetches this once per shop and every Avatar reads from it.

Scoped to the caller's own shop, from the session - there is no request shape that returns another shop's roster.