User avatar (Google picture), avatar in mobile You tab, /account page

- Capture the Google profile picture (picture claim) into users.avatar_url; an
  Avatar component shows it, falling back to the initial. Used in the desktop
  header and the mobile "You" tab (which now shows the user when signed in).
- Move account/settings to its own route /account (robust + scrolls to top),
  reached by the desktop avatar and the mobile You tab; drop the inline "You"
  sheet. AccountPanel gains a Sign out action; the page links to Saved/History/
  Boundaries via home intent params (?view= / ?open=).
- db: users.avatar_url (schema + idempotent migration). 118 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_oauth.py

@@ -32,9 +32,10 @@ def test_auth_url_has_required_params(monkeypatch):
 def test_verify_id_token_happy(monkeypatch):
     monkeypatch.setenv("GOODNEWS_GOOGLE_CLIENT_ID", "cid")
     tok = _token({"iss": "https://accounts.google.com", "aud": "cid", "exp": 9999999999,
-                  "sub": "g-123", "email": "a@b.com", "email_verified": True, "name": "A"})
+                  "sub": "g-123", "email": "a@b.com", "email_verified": True, "name": "A",
+                  "picture": "https://x/p.jpg"})
     info = g.verify_id_token(tok)
-    assert info == {"sub": "g-123", "email": "a@b.com", "name": "A"}
+    assert info == {"sub": "g-123", "email": "a@b.com", "name": "A", "picture": "https://x/p.jpg"}
 
 
 def test_verify_id_token_rejects(monkeypatch):