feat(backend:users): add avatar synchronization for OIDC users

[q16marvin]

Summary

Add automatic OIDC avatar import from the standard picture claim.

Details

After successful OIDC login, Sync-in now:

• reads picture from userinfo
• validates the URL
• downloads the image
• checks content type and size
• converts it to PNG with sharp
• stores it as the regular local user avatar

Avatar sync errors are logged but do not prevent login.

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}