Show the OIDC profile picture with an identicon fallback

GET /api/me now carries the profile picture URL when the provider
supplies an absolute http(s) one; the SPA shows it in the lobby navbar
and draws a deterministic identicon from the sub otherwise, falling back
to the identicon when the image fails to load.

The identicon is a 5x5 mirrored grid seeded by an inline FNV-1a hash so
it stays stable across Rust versions and is unit-testable on the host.
The dev mock IdP hands alice and bob a picture claim.

server/tests/helpers/oidc.py

@@ -24,25 +24,34 @@ _PROVIDER = next(iter(oidc.providers))
 
 
 def make_user(
-    sub: str, name: Optional[str] = None, email: Optional[str] = None
+    sub: str,
+    name: Optional[str] = None,
+    email: Optional[str] = None,
+    picture: Optional[str] = None,
 ) -> OIDCUser:
     claims = {"sub": sub, "preferred_username": name or sub}
     if email:
         claims["email"] = email
+    if picture:
+        claims["picture"] = picture
     return OIDCUser(claims)
 
 
 @contextlib.contextmanager
 def oidc_user(
-    sub: str, name: Optional[str] = None, email: Optional[str] = None
+    sub: str,
+    name: Optional[str] = None,
+    email: Optional[str] = None,
+    picture: Optional[str] = None,
 ) -> Iterator[OIDCUser]:
     """Context manager: make ``oidc.get_users`` return this user.
 
     ``email`` is optional so tests can simulate an IdP that still returns
     the claim: the app requests only the ``openid`` and ``profile`` scopes
-    and ignores email where present.
+    and ignores email where present. ``picture`` simulates the profile
+    scope's avatar claim.
     """
-    user = make_user(sub, name, email)
+    user = make_user(sub, name, email, picture)
     patcher = _mock.patch.object(oidc, "get_users", return_value={_PROVIDER: user})
     patcher.start()
     try: