Copy the signed-in member's avatar into the private rep photo bucket

Copies bytes only. The public avatar stays public. A default color avatar has no bytes and returns 400. The response is a storage path. The browser writes that path onto rep_profiles with the user's own session so the change audit records them.