Fix: capture Google avatar on returning sign-in (+ userinfo fallback)

find_or_create_user returned early when the identity already existed, so a
returning Google sign-in never refreshed the profile picture (the name had been
set earlier, at link time — which is why name worked but avatar stayed null).
Now profile bits refresh on every sign-in. Also fall back to the OIDC userinfo
endpoint for the picture if the ID token omits it. 119 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

goodnews/api.py

@@ -432,6 +432,8 @@ def create_app() -> FastAPI:
         try:
             tokens = oauth_google.exchange_code(code, _google_redirect_uri(), verifier)
             info = oauth_google.verify_id_token(tokens["id_token"])
+            if not info.get("picture") and tokens.get("access_token"):
+                info["picture"] = oauth_google.fetch_userinfo(tokens["access_token"]).get("picture")
         except Exception:
             return fail
         with get_conn() as conn: