feat: Gravatar opt-in (off by default), configurable in Settings

Previously every account without a custom avatar automatically got
its email MD5-hashed and sent to gravatar.com at signup, with no way
to turn it off. Adds users.useGravatar (default false): removed the
automatic signup-time lookup entirely, and "remove photo" now falls
back to the initials placeholder instead of silently re-deriving a
Gravatar URL. New toggle in Settings -> Profile, off by default,
description explains the MD5-hash-to-third-party tradeoff. Existing
accounts' current avatarUrl is left untouched either way — no
retroactive avatar changes for anyone already using one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/src/schema/users.ts

@@ -21,6 +21,10 @@ export const users = pgTable("users", {
   name: text("name").notNull(),
   avatarUrl: text("avatar_url"),
   hasCustomAvatar: boolean("has_custom_avatar").notNull().default(false),
+  // Off by default — Gravatar is looked up by an MD5 hash of the user's
+  // email, sent to a third party (gravatar.com), which some users won't want
+  // regardless of MD5 being effectively reversible for a known email.
+  useGravatar: boolean("use_gravatar").notNull().default(false),
   bio: text("bio"),
   privateBio: text("private_bio"),
   isPrivate: boolean("is_private").notNull().default(false),