feat: profile pictures — Gravatar fallback + custom upload

New users get a Gravatar-backed avatar automatically (computed from email
at signup); users can upload a custom photo instead via Settings, or
revert to the Gravatar/initials fallback. avatarUrl stays the single
resolved value (custom photo, OAuth photo, or precomputed Gravatar URL)
so every existing avatar-rendering spot across the app needs zero changes.

- users.hasCustomAvatar tracks whether avatarUrl is a real upload vs a
  computed Gravatar fallback, so "remove photo" knows what to revert to.
- New /api/v1/upload/avatar-presign route (session-scoped, generic —
  the existing recipe-photo presign route required a recipeId).
- CSP img-src needed www.gravatar.com added, or every browser blocks
  the fallback avatar outright.
- Settings page now reads avatarUrl from a fresh DB query instead of
  Better Auth's session object — the session cookie cache (5 min TTL)
  was serving a stale image right after upload, showing the initials
  fallback until the cache happened to expire.

Verified locally: signup auto-sets a Gravatar URL, upload persists
across reload, remove correctly reverts to Gravatar/initials.

packages/db/src/migrations/0032_boring_layla_miller.sql

@@ -0,0 +1 @@
+ALTER TABLE "users" ADD COLUMN "has_custom_avatar" boolean DEFAULT false NOT NULL;

packages/db/src/schema/users.ts

@@ -19,6 +19,7 @@ export const users = pgTable("users", {
   emailVerified: boolean("email_verified").notNull().default(false),
   name: text("name").notNull(),
   avatarUrl: text("avatar_url"),
+  hasCustomAvatar: boolean("has_custom_avatar").notNull().default(false),
   bio: text("bio"),
   privateBio: text("private_bio"),
   isPrivate: boolean("is_private").notNull().default(false),