feat: profile pictures — Gravatar fallback + custom upload

New users get a Gravatar-backed avatar automatically (computed from email
at signup); users can upload a custom photo instead via Settings, or
revert to the Gravatar/initials fallback. avatarUrl stays the single
resolved value (custom photo, OAuth photo, or precomputed Gravatar URL)
so every existing avatar-rendering spot across the app needs zero changes.

- users.hasCustomAvatar tracks whether avatarUrl is a real upload vs a
  computed Gravatar fallback, so "remove photo" knows what to revert to.
- New /api/v1/upload/avatar-presign route (session-scoped, generic —
  the existing recipe-photo presign route required a recipeId).
- CSP img-src needed www.gravatar.com added, or every browser blocks
  the fallback avatar outright.
- Settings page now reads avatarUrl from a fresh DB query instead of
  Better Auth's session object — the session cookie cache (5 min TTL)
  was serving a stale image right after upload, showing the initials
  fallback until the cache happened to expire.

Verified locally: signup auto-sets a Gravatar URL, upload persists
across reload, remove correctly reverts to Gravatar/initials.

apps/web/lib/auth/server.ts

@@ -5,6 +5,7 @@ import { db, users, sessions, accounts, verifications, eq, count } from "@epicur
 import { sendEmail, verifyEmailHtml, resetPasswordHtml, welcomeHtml } from "@/lib/email";
 import { isSignupsDisabled } from "@/lib/site-settings";
 import { findValidInvite, consumeInvite, INVITE_COOKIE } from "@/lib/invites";
+import { gravatarUrl } from "@/lib/gravatar";
 
 export const auth = betterAuth({
   trustedOrigins: [process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000"],
@@ -100,6 +101,13 @@ export const auth = betterAuth({
             await db.update(users).set({ role: "admin" }).where(eq(users.id, user.id));
           }
 
+          // Only email/password signups land here without an avatar already
+          // set (OAuth providers set `image` — mapped to avatarUrl — before
+          // this hook runs) — give them a Gravatar-backed default.
+          if (!user.image) {
+            await db.update(users).set({ avatarUrl: gravatarUrl(user.email) }).where(eq(users.id, user.id));
+          }
+
           // Consume the invite that gated this signup, if any (regardless of
           // whether signups have since been re-enabled/disabled).
           const token = context?.getCookie(INVITE_COOKIE);

apps/web/lib/gravatar.ts

@@ -0,0 +1,11 @@
+import { createHash } from "crypto";
+
+// Gravatar keys avatars by MD5 of the trimmed, lowercased email — no other
+// normalization is defined by their API.
+export function gravatarUrl(email: string, size = 200): string {
+  const hash = createHash("md5").update(email.trim().toLowerCase()).digest("hex");
+  // d=404 makes Gravatar 404 instead of serving a placeholder when no avatar
+  // is registered for the hash, so callers relying on <img onError> fallback
+  // (e.g. the Avatar component's initials fallback) behave correctly.
+  return `https://www.gravatar.com/avatar/${hash}?s=${size}&d=404`;
+}