feat: Gravatar opt-in (off by default), configurable in Settings

Previously every account without a custom avatar automatically got
its email MD5-hashed and sent to gravatar.com at signup, with no way
to turn it off. Adds users.useGravatar (default false): removed the
automatic signup-time lookup entirely, and "remove photo" now falls
back to the initials placeholder instead of silently re-deriving a
Gravatar URL. New toggle in Settings -> Profile, off by default,
description explains the MD5-hash-to-third-party tradeoff. Existing
accounts' current avatarUrl is left untouched either way — no
retroactive avatar changes for anyone already using one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/settings/page.tsx

@@ -12,7 +12,7 @@ export default async function SettingsPage() {
 
   const dbUser = await db.query.users.findFirst({
     where: eq(users.id, session.user.id),
-    columns: { bio: true, privateBio: true, isPrivate: true, hasCustomAvatar: true, avatarUrl: true, username: true },
+    columns: { bio: true, privateBio: true, isPrivate: true, hasCustomAvatar: true, avatarUrl: true, username: true, useGravatar: true },
   });
 
   return (
@@ -27,6 +27,7 @@ export default async function SettingsPage() {
         isPrivate: dbUser?.isPrivate ?? false,
         hasCustomAvatar: dbUser?.hasCustomAvatar ?? false,
         username: dbUser?.username ?? null,
+        useGravatar: dbUser?.useGravatar ?? false,
       }}
     />
   );

apps/web/app/api/v1/users/me/route.ts

@@ -13,8 +13,12 @@ const PatchSchema = z.object({
   privateBio: z.string().max(2000).optional().nullable(),
   isPrivate: z.boolean().optional(),
   username: z.string().trim().toLowerCase().regex(USERNAME_PATTERN, "3-20 characters, lowercase letters, numbers, and underscores only").optional(),
-  // A custom-uploaded avatar URL, or null to revert to the Gravatar fallback.
+  // A custom-uploaded avatar URL, or null to revert to the initials fallback
+  // (or Gravatar, if useGravatar is on — see below).
   avatarUrl: z.string().url().max(2048).optional().nullable(),
+  // Off by default (Settings → Profile) — Gravatar is looked up by an MD5
+  // hash of the user's email, sent to a third party.
+  useGravatar: z.boolean().optional(),
 });
 
 export async function PATCH(req: Request) {
@@ -28,11 +32,23 @@ export async function PATCH(req: Request) {
     return NextResponse.json({ error: "Username already taken" }, { status: 409 });
   }
 
-  const { avatarUrl, ...rest } = body.data;
+  const { avatarUrl, useGravatar, ...rest } = body.data;
   const updates: Partial<typeof users.$inferInsert> = { ...rest };
+
+  // useGravatar is only ever toggled from the settings form, never alongside
+  // an avatar upload/removal in the same request — so it's fine for these
+  // two branches to each independently decide the resulting avatarUrl below.
+  if (useGravatar !== undefined) {
+    updates.useGravatar = useGravatar;
+    if (!(await hasCustomAvatar(session.user.id))) {
+      updates.avatarUrl = useGravatar ? gravatarUrl(session.user.email) : null;
+    }
+  }
+
   if (avatarUrl !== undefined) {
     if (avatarUrl === null) {
-      updates.avatarUrl = gravatarUrl(session.user.email);
+      const gravatarOptedIn = useGravatar ?? (await getUseGravatar(session.user.id));
+      updates.avatarUrl = gravatarOptedIn ? gravatarUrl(session.user.email) : null;
       updates.hasCustomAvatar = false;
     } else {
       updates.avatarUrl = avatarUrl;
@@ -43,3 +59,13 @@ export async function PATCH(req: Request) {
   await db.update(users).set(updates).where(eq(users.id, session.user.id));
   return NextResponse.json({ ok: true, avatarUrl: updates.avatarUrl });
 }
+
+async function hasCustomAvatar(userId: string): Promise<boolean> {
+  const row = await db.query.users.findFirst({ where: eq(users.id, userId), columns: { hasCustomAvatar: true } });
+  return row?.hasCustomAvatar ?? false;
+}
+
+async function getUseGravatar(userId: string): Promise<boolean> {
+  const row = await db.query.users.findFirst({ where: eq(users.id, userId), columns: { useGravatar: true } });
+  return row?.useGravatar ?? false;
+}