feat: Implement identity lock screen for sensitive user actions and introduce avatar generation.

src/lib/swarm/user-cache.ts

@@ -23,21 +23,37 @@ export async function upsertRemoteUser(profile: RemoteProfile) {
 
         if (existing) {
             // Update metadata if changed
+            let avatarUrl = profile.avatarUrl || existing.avatarUrl;
+
+            // If still no avatar, generate one and save it "permanently"
+            if (!avatarUrl) {
+                const { generateAndUploadAvatar } = await import('@/lib/auth/avatar');
+                avatarUrl = await generateAndUploadAvatar(profile.handle);
+            }
+
             await db.update(users)
                 .set({
                     displayName: profile.displayName || existing.displayName,
-                    avatarUrl: profile.avatarUrl || existing.avatarUrl,
+                    avatarUrl: avatarUrl,
                     isBot: profile.isBot ?? existing.isBot,
                     updatedAt: new Date(),
                 })
                 .where(eq(users.id, existing.id));
         } else {
+            let avatarUrl = profile.avatarUrl;
+
+            // If no avatar provided, generate one
+            if (!avatarUrl) {
+                const { generateAndUploadAvatar } = await import('@/lib/auth/avatar');
+                avatarUrl = await generateAndUploadAvatar(profile.handle);
+            }
+
             // Create new placeholder user
             await db.insert(users).values({
                 did: profile.did,
                 handle: profile.handle, // user@domain
                 displayName: profile.displayName || profile.handle,
-                avatarUrl: profile.avatarUrl || null,
+                avatarUrl: avatarUrl,
                 isBot: profile.isBot || false,
                 publicKey: '', // We don't necessarily have their public key yet, but DMs often do
                 // Note: nodeId is null for remote placeholders unless we specifically link it