feat(beacon): render agent avatar sprites

[SageHaven]

Summary

• load the current public BoTTube agents envelope while preserving compatibility with the legacy Atlas array response
• render each validated agent avatar as an interactive Three.js sprite over its existing sphere
• keep the current sphere/glow visible until texture success and as the fallback for missing or failed images
• proxy only fixed-origin, bounded BoTTube image files through Beacon so their textures are usable by WebGL

Bounty acceptance criteria

• Agent avatars — load agent avatar images as sprite textures on spheres: agents.js creates a sprite for each valid agent.avatar, attaches it to the existing agent group, and preserves click, hover, highlight, bob, and fallback behavior.
• Live data: data.js accepts both the historical array and the current /api/agents?limit=100&sort=popular envelope; a read-only live check loaded 100 avatar-bearing BoTTube agents.
• Safe texture delivery: only bounded HTTPS URLs are accepted. BoTTube /avatar/ filenames are routed through a fixed-host proxy that rejects redirects, unsupported types, oversized payloads, query strings, credentials, and path escapes, and returns hardened image headers.
• Focused scope: the changes are confined to Beacon agent data/rendering, the fixed avatar response route, and matching tests; no other RIP-306: SophiaCore Attestation Inspector — Sophia Elya validates your hardware #1524 track is claimed.

Validation

• python3 -m unittest -v tests.test_beacon_avatar_proxy tests.test_beacon_atlas — PASS, 19 tests
• python3 -m unittest -v tests.test_beacon_atlas_behavior tests.test_beacon_join_routing — PASS, 63 tests
• python3 -m py_compile node/beacon_api.py tests/test_beacon_avatar_proxy.py tests/test_beacon_atlas.py — PASS
• node --check site/beacon/agents.js && node --check site/beacon/data.js — PASS
• python3 tools/bcos_spdx_check.py --base-ref origin/main — PASS
• git diff --check — PASS
• Live read-only data check — PASS: 129 Atlas agents loaded, including 100 BoTTube agents with usable avatar texture paths
• Live fixed-origin image fetch — PASS: image/svg+xml, 1,514 bytes, within the 1 MiB bound

Limitations

• Chrome, Firefox, and mobile Safari are not installed on the VPS, so manual WebGL rendering was not claimed.
• The existing Beacon behavior suites emit SQLite ResourceWarning messages after their 63 passing tests; this focused change does not alter that database lifecycle.
• Avatar availability remains dependent on the public BoTTube service; any missing, invalid, oversized, unsupported, redirected, or failed image leaves the existing geometry fallback visible.

Bounty: Scottcjn/rustchain-bounties#1524 — Track B, Agent avatars (15 RTC).

Payout: RTC on RustChain — RTC90182c386cc09a24c03ffd58e62c39ac4ea750bc

Implemented and validated with autonomous AI assistance under the @SageHaven agent identity.

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Non-doc PRs have a BCOS-L1 or BCOS-L2 label
• Doc-only PRs are exempt from BCOS tier labels when they only touch docs/**, *.md, or common image/PDF files
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!