fix(images): cap and stream image decoding in a GL-free decoder

Image decoding lived in the GL texture file and had no limits: a file of
any size was read whole, stb and libwebp allocated whatever the header
claimed (a WebP alone up to 1 GB), and a GIF was decoded at full size,
every frame, before the 300-frame cap. A 720p 150-frame GIF avatar cost
0.2-1.5 s and 140-370 MB on the UI thread. stb's GIF loader also read
before the start of its buffer on disposal-3 frames, and when a long GIF
ran out of memory it freed the frame delays that the caller then freed
again (an abort).

Decoding, and the stb implementation, now live in the GL-free
util/image_decode_core, safe on any thread:

- the header is probed first; stills above 256 MP, any GIF or animated
  WebP canvas above 32 Mi px, and files above 256 MiB are rejected
  before anything is allocated (real photos, 200 MP phone shots and
  wide panoramas still load);
- a GIF decodes one composited frame at a time, downscaled as it goes,
  and stops at the frame cap: peak memory is stb's working buffers, two
  canvases and the small frames; a truncated GIF keeps the frames
  decoded so far;
- a header stb cannot read means "unsupported", never a blind decode;
- decodes above 16 MP run one at a time; a decode can be cancelled
  between frames.

util::StartImageDecode runs one decode on a detached worker that owns its
job and its lane's in-flight counter, so nothing waits at exit; the next
commits move avatars and the image picker onto it. The limits apply now
to avatars and the picker's hover previews; thumbnails and avatar imports
get them when they move to workers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CMakeLists.txt

@@ -571,6 +571,7 @@ set(APP_SOURCES
     src/util/platform.cpp
     src/util/payment_uri.cpp
     src/util/texture_loader.cpp
+    src/util/image_decode_core.cpp
     src/util/svg_texture.cpp
     src/util/noise_texture.cpp
     src/daemon/embedded_daemon.cpp
@@ -1210,6 +1211,7 @@ if(BUILD_TESTING)
         src/util/seed_phrase.cpp
         src/util/i18n.cpp
         src/util/text_format.cpp
+        src/util/image_decode_core.cpp
         src/data/wallet_state.cpp
         src/data/transaction_history_cache.cpp
         src/data/transaction_history_store_policy.cpp
@@ -1243,6 +1245,7 @@ if(BUILD_TESTING)
         ${SODIUM_INCLUDE_DIR}
         ${CURL_INCLUDE_DIRS}
         ${MINIZ_DIR}
+        ${libwebp_SOURCE_DIR}/src   # <webp/decode.h>, <webp/demux.h> for image_decode_core.cpp
     )
 
     target_link_libraries(ObsidianDragonTests PRIVATE
@@ -1250,6 +1253,8 @@ if(BUILD_TESTING)
         sqlite3_amalgamation
         ${SODIUM_LIBRARY}
         ${CURL_LIBRARIES}
+        webp
+        webpdemux
     )
 
     target_compile_definitions(ObsidianDragonTests PRIVATE