feat: profile pictures — Gravatar fallback + custom upload

New users get a Gravatar-backed avatar automatically (computed from email
at signup); users can upload a custom photo instead via Settings, or
revert to the Gravatar/initials fallback. avatarUrl stays the single
resolved value (custom photo, OAuth photo, or precomputed Gravatar URL)
so every existing avatar-rendering spot across the app needs zero changes.

- users.hasCustomAvatar tracks whether avatarUrl is a real upload vs a
  computed Gravatar fallback, so "remove photo" knows what to revert to.
- New /api/v1/upload/avatar-presign route (session-scoped, generic —
  the existing recipe-photo presign route required a recipeId).
- CSP img-src needed www.gravatar.com added, or every browser blocks
  the fallback avatar outright.
- Settings page now reads avatarUrl from a fresh DB query instead of
  Better Auth's session object — the session cookie cache (5 min TTL)
  was serving a stale image right after upload, showing the initials
  fallback until the cache happened to expire.

Verified locally: signup auto-sets a Gravatar URL, upload persists
across reload, remove correctly reverts to Gravatar/initials.

apps/web/app/api/v1/users/me/route.ts

@@ -3,6 +3,7 @@ import { headers } from "next/headers";
 import { auth } from "@/lib/auth/server";
 import { db, users, eq } from "@epicure/db";
 import { z } from "zod";
+import { gravatarUrl } from "@/lib/gravatar";
 
 const PatchSchema = z.object({
   name: z.string().min(1).max(100).optional(),
@@ -10,6 +11,8 @@ const PatchSchema = z.object({
   bio: z.string().max(500).optional().nullable(),
   privateBio: z.string().max(2000).optional().nullable(),
   isPrivate: z.boolean().optional(),
+  // A custom-uploaded avatar URL, or null to revert to the Gravatar fallback.
+  avatarUrl: z.string().url().max(2048).optional().nullable(),
 });
 
 export async function PATCH(req: Request) {
@@ -19,6 +22,18 @@ export async function PATCH(req: Request) {
   const body = PatchSchema.safeParse(await req.json());
   if (!body.success) return NextResponse.json({ error: body.error.flatten() }, { status: 400 });
 
-  await db.update(users).set(body.data).where(eq(users.id, session.user.id));
-  return NextResponse.json({ ok: true });
+  const { avatarUrl, ...rest } = body.data;
+  const updates: Partial<typeof users.$inferInsert> = { ...rest };
+  if (avatarUrl !== undefined) {
+    if (avatarUrl === null) {
+      updates.avatarUrl = gravatarUrl(session.user.email);
+      updates.hasCustomAvatar = false;
+    } else {
+      updates.avatarUrl = avatarUrl;
+      updates.hasCustomAvatar = true;
+    }
+  }
+
+  await db.update(users).set(updates).where(eq(users.id, session.user.id));
+  return NextResponse.json({ ok: true, avatarUrl: updates.avatarUrl });
 }