feat: add Gravatar fallbacks for email-backed users

[steipete]

What Problem This Solves

Email-backed users without an explicit or provider-supplied avatar currently fall back to initials even when they have a Gravatar profile. Existing users also keep that blank avatar state indefinitely.

Why This Change Was Made

The server now derives the current Gravatar SHA-256 URL from private identity email data, keeps email out of public user payloads, and stores the effective fallback so every existing avatar surface benefits without an API shape change. Custom and provider avatars retain precedence, clearing a custom avatar restores the fallback, late identity data is handled safely, and migration startup backfills legacy blank avatars for both SQLite and Postgres.

User Impact

Email-backed human users automatically receive their Gravatar image or a deterministic identicon when they have no other avatar. Users without email still use initials, and custom/provider avatar behavior remains intact.

Evidence

• pnpm check
• go test -race ./apps/api/internal/store/sqlite
• pnpm docs:site
• Source-blind local behavior validation through the built app and public API confirmed stable Gravatar URLs, explicit URL precedence, clear-to-restore behavior, blank bot avatars, and no public email field.
• Independent source review verified SQLite/Postgres parity, migration backfill, and concurrent late-email/provider/profile-clear behavior.