Avatars: a sender without one logged a console error; phone list rows spaced 20px

A missing avatar was a 404, which the browser reports as an error for every
such sender on every page. It is now an empty 204: the <img> still fails to
decode it and the initials show through, but nothing is logged, and the miss
carries the same one-day browser cache as a hit so it stops being re-fetched.

On a phone the mail list's rows sit 20px apart instead of 7px.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/tests/api/test_avatar.py

@@ -2,7 +2,7 @@
 
 The shared Redis client decodes replies as text, so the cache of raw image
 bytes broke on the second request for any sender — a 500 instead of the image
-(or instead of the 404 that means "draw initials").
+(or instead of the 204 that means "draw initials").
 """
 
 from __future__ import annotations
@@ -68,7 +68,7 @@ async def test_cached_avatar_is_served_again(
     assert calls == 1  # the second came from the cache
 
 
-async def test_cached_miss_is_a_404_again(
+async def test_cached_miss_is_a_204_again(
     client: httpx.AsyncClient, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     calls = 0
@@ -81,5 +81,8 @@ async def test_cached_miss_is_a_404_again(
     monkeypatch.setattr(avatar, "_resolve", fake_resolve)
     for _ in range(2):
         resp = await client.get("/api/avatar", params={"email": "nobody@example.com"})
-        assert resp.status_code == 404
+        # 204, not 404: a miss is the normal case, and a 404 put a console
+        # error in the browser for every sender without an avatar.
+        assert resp.status_code == 204
+        assert "max-age" in resp.headers["cache-control"]
     assert calls == 1