feat: Gravatar opt-in (off by default), configurable in Settings

Previously every account without a custom avatar automatically got
its email MD5-hashed and sent to gravatar.com at signup, with no way
to turn it off. Adds users.useGravatar (default false): removed the
automatic signup-time lookup entirely, and "remove photo" now falls
back to the initials placeholder instead of silently re-deriving a
Gravatar URL. New toggle in Settings -> Profile, off by default,
description explains the MD5-hash-to-third-party tradeoff. Existing
accounts' current avatarUrl is left untouched either way — no
retroactive avatar changes for anyone already using one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/messages/fr.json

@@ -1139,6 +1139,8 @@
     },
     "profile": "Profil",
     "changePhoto": "Changer la photo",
+    "useGravatar": "Utiliser Gravatar",
+    "useGravatarDescription": "Afficher une photo Gravatar quand vous n'en avez pas mis en ligne — envoie un hash MD5 de votre e-mail à gravatar.com. Désactivé par défaut.",
     "removePhoto": "Supprimer la photo",
     "avatarUploadSuccess": "Photo de profil mise à jour",
     "avatarUploadFailed": "Échec de la mise à jour de la photo de profil",