User avatar (Google picture), avatar in mobile You tab, /account page

- Capture the Google profile picture (picture claim) into users.avatar_url; an
  Avatar component shows it, falling back to the initial. Used in the desktop
  header and the mobile "You" tab (which now shows the user when signed in).
- Move account/settings to its own route /account (robust + scrolls to top),
  reached by the desktop avatar and the mobile You tab; drop the inline "You"
  sheet. AccountPanel gains a Sign out action; the page links to Saved/History/
  Boundaries via home intent params (?view= / ?open=).
- db: users.avatar_url (schema + idempotent migration). 118 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

goodnews/oauth_google.py

@@ -98,4 +98,9 @@ def verify_id_token(id_token: str) -> dict:
         raise ValueError("id_token expired")
     if not claims.get("email") or claims.get("email_verified") not in (True, "true"):
         raise ValueError("email not verified")
-    return {"sub": str(claims["sub"]), "email": claims["email"], "name": claims.get("name")}
+    return {
+        "sub": str(claims["sub"]),
+        "email": claims["email"],
+        "name": claims.get("name"),
+        "picture": claims.get("picture"),
+    }