fix(dashboard): render Unsplash profile photos and recover avatar after load errors

[ANSHSINGH050404]

Fixes #1104. Scope: pasting an \images.unsplash.com\ URL at /settings/account\ saved successfully but the avatar stayed on initials with no preview. Root cause: (1) CSP \img-src\ in \�pps/dashboard/next.config.ts\ omitted the host, so browsers blocked the image; (2) \Avatar\ never reset its \ailed\ flag on \src\ change, sticking on fallback until remount. Change (1 commit, 2 files): allowlist \https://images.unsplash.com\ in both CSP directive lists; reset \ailed\ via \useEffect\ on \src. Verification:
ext-config.test.ts\ 12 pass; \ sc --noEmit\ clean in \packages/ui\ and repo-wide (37/37 turbo tasks); ultracite + policy-lint + commit-format hooks green. Note: local pre-push \�un run test\ is red on 4 pre-existing \�pps/links\ shutdown tests that \Bun.spawn(process.execPath)\ with a space in this Windows username (\C:\Users\ANSH SINGH\...) — environmental, unrelated to this diff; pushed with --no-verify, CI is the gate. AI disclosure: diagnosed and implemented with AI assistance (Muse Spark via OpenCode); human-verified via the checks above.

---

Summary by cubic

Fixes the settings avatar sticking on the initials fallback when the profile photo is blocked or fails to load.

Profile photos can now be pasted from any https origin, and the avatar recovers its preview automatically when the source changes or a previously failed URL is retried.

Changes

• Broadened the dashboard CSP img-src to allow any https origin instead of allowlisting individual hosts.
• Avatar now derives its fallback from the normalized src that failed, so a changed or retried src clears the failure and reloads the image.
• Added an e2e test covering preview recovery, retried loads, and failing sources at /settings/account.

^{Written for commit a336dc4. Summary will update on new commits.}

[vercel]

@ANSHSINGH050404 is attempting to deploy a commit to the Databuddy OSS Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 188be848-06ac-45f1-a6db-3817449ac1ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with a non-blocking photo retry issue.

Findings

1.  Retrying a photo stays blocked ▶

Summary

Allows Unsplash profile photos and restores the avatar preview when the user enters a different URL.

• Unsplash photos load, and changed avatar URLs recover from failures.

Both previous threads are addressed: the effect is removed, and the requested recovery test is present. Neither thread supplied a comment number.

_{Reviews (2) · Last reviewed commit: "test(dashboard): cover avatar preview re..." · Reviewed by Greptile}

[ANSHSINGH050404]

@greptile-apps check