Fix: capture Google avatar on returning sign-in (+ userinfo fallback)

find_or_create_user returned early when the identity already existed, so a
returning Google sign-in never refreshed the profile picture (the name had been
set earlier, at link time — which is why name worked but avatar stayed null).
Now profile bits refresh on every sign-in. Also fall back to the OIDC userinfo
endpoint for the picture if the ID token omits it. 119 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_auth.py

@@ -33,6 +33,15 @@ def test_find_or_create_links_by_email_and_dedupes_identity():
     assert auth.get_user(c, uid)["display_name"] == "A"
 
 
+def test_returning_identity_refreshes_avatar():
+    c = _db()
+    uid = auth.find_or_create_user(c, "a@b.com", "google", "gsub", display_name="A", avatar_url="http://pic/1")
+    assert auth.get_user(c, uid)["avatar_url"] == "http://pic/1"
+    # a repeat sign-in with the SAME identity must still refresh the picture
+    assert auth.find_or_create_user(c, "a@b.com", "google", "gsub", avatar_url="http://pic/2") == uid
+    assert auth.get_user(c, uid)["avatar_url"] == "http://pic/2"
+
+
 def test_magic_link_token_single_use():
     c = _db()
     raw = auth.create_login_token(c, "a@b.com")