feat: Gravatar opt-in (off by default), configurable in Settings

Previously every account without a custom avatar automatically got
its email MD5-hashed and sent to gravatar.com at signup, with no way
to turn it off. Adds users.useGravatar (default false): removed the
automatic signup-time lookup entirely, and "remove photo" now falls
back to the initials placeholder instead of silently re-deriving a
Gravatar URL. New toggle in Settings -> Profile, off by default,
description explains the MD5-hash-to-third-party tradeoff. Existing
accounts' current avatarUrl is left untouched either way — no
retroactive avatar changes for anyone already using one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/auth/server.ts

@@ -5,7 +5,6 @@ import { db, users, sessions, accounts, verifications, twoFactors, eq, count } f
 import { sendEmail, verifyEmailHtml, resetPasswordHtml, welcomeHtml } from "@/lib/email";
 import { isSignupsDisabled } from "@/lib/site-settings";
 import { findValidInvite, consumeInvite, INVITE_COOKIE } from "@/lib/invites";
-import { gravatarUrl } from "@/lib/gravatar";
 import { generateUniqueUsername } from "@/lib/username";
 
 export const auth = betterAuth({
@@ -130,12 +129,11 @@ export const auth = betterAuth({
             await db.update(users).set({ role: "admin" }).where(eq(users.id, user.id));
           }
 
-          // Only email/password signups land here without an avatar already
-          // set (OAuth providers set `image` — mapped to avatarUrl — before
-          // this hook runs) — give them a Gravatar-backed default.
-          if (!user.image) {
-            await db.update(users).set({ avatarUrl: gravatarUrl(user.email) }).where(eq(users.id, user.id));
-          }
+          // Gravatar is opt-in (Settings → Profile), off by default — no
+          // automatic Gravatar lookup at signup. OAuth providers still set
+          // `image` (mapped to avatarUrl) before this hook runs; email/
+          // password signups just get the initials fallback until the user
+          // uploads a photo or opts into Gravatar.
 
           // Consume the invite that gated this signup, if any (regardless of
           // whether signups have since been re-enabled/disabled).