Serves the stored avatar image, 48x48 variant. This is the URL returned as path by the avatar metadata endpoints.No authentication required — avatars are public by design so any UI can embed them directly in an <img> tag.Caching:Cache-Control: public, max-age=2592000 (30 days), plus Expires, Last-Modified and a strong ETag. Conditional requests are answered with a bodyless 304: send If-None-Match (preferred) or If-Modified-Since.Formats: avatars are stored as WebP. Request the same hash with a .jpg or .png extension and the image is transcoded on the fly and cached on disk, for clients that cannot render WebP.Filenames are opaque MD5 hashes and are validated against ^[a-f0-9]{32}\.(jpg|png|webp)$ — they carry no user information and cannot be used to enumerate users.