Fix: capture Google avatar on returning sign-in (+ userinfo fallback)

find_or_create_user returned early when the identity already existed, so a
returning Google sign-in never refreshed the profile picture (the name had been
set earlier, at link time — which is why name worked but avatar stayed null).
Now profile bits refresh on every sign-in. Also fall back to the OIDC userinfo
endpoint for the picture if the ID token omits it. 119 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

goodnews/auth.py

@@ -69,27 +69,29 @@ def find_or_create_user(
         (provider, provider_subject),
     ).fetchone()
     if existing:
-        return existing["user_id"]
+        user_id = existing["user_id"]
+    else:
+        user = conn.execute("SELECT id FROM users WHERE email = ?", (email,)).fetchone()
+        if user:
+            user_id = user["id"]
+        else:
+            user_id = conn.execute(
+                "INSERT INTO users (email, display_name, avatar_url) VALUES (?, ?, ?)",
+                (email, display_name, avatar_url),
+            ).lastrowid
+        conn.execute(
+            "INSERT OR IGNORE INTO identities (user_id, provider, provider_subject) VALUES (?, ?, ?)",
+            (user_id, provider, provider_subject),
+        )
 
-    user = conn.execute("SELECT id FROM users WHERE email = ?", (email,)).fetchone()
-    if user:
-        user_id = user["id"]
-        # Fill display name if missing; refresh avatar whenever the provider gives one.
+    # Always refresh provider-supplied profile bits (even for a returning identity):
+    # fill the name if missing, and keep the avatar current when the provider sends one.
+    if display_name or avatar_url:
         conn.execute(
             "UPDATE users SET display_name = COALESCE(display_name, ?), "
             "avatar_url = COALESCE(?, avatar_url), updated_at = CURRENT_TIMESTAMP WHERE id = ?",
             (display_name, avatar_url, user_id),
         )
-    else:
-        user_id = conn.execute(
-            "INSERT INTO users (email, display_name, avatar_url) VALUES (?, ?, ?)",
-            (email, display_name, avatar_url),
-        ).lastrowid
-
-    conn.execute(
-        "INSERT OR IGNORE INTO identities (user_id, provider, provider_subject) VALUES (?, ?, ?)",
-        (user_id, provider, provider_subject),
-    )
     return user_id