image-proxy profile-image gate not widened for /usuarios peer directory — students get broken avatars

MARS-555 opened /usuarios to all authenticated users with basic tier rendering peer name/avatar/roles/email, but the image-proxy profile-image branch (src/app/api/image/[id]/route.ts:90-108) still only allows self/fullAccess/owner-in-viewer-teacher-scope — predates /usuarios, written for /alumnos/[id]. A plain alumno viewing a peer avatar gets 404 → broken avatars in the directory + profile-image-access-denied warn noise (id=73c9b78f, legit-user-blocked). Fix: widen the PROFILE-IMAGE branch to allow any authenticated user (consistent with the peer-visible basic-tier decision; email already peer-visible). Clinical/práctica image scoping stays UNCHANGED. Class-A (auth-gate) — audit design-ping pre-impl + diff review pre-push.