The face from the provider, and whose business a password is

The password tab was hidden for accounts with no password, which is not the
same as accounts that sign in through the provider — an account linked to one
kept its password and therefore kept the tab. That is precisely the account
the person setting this up is using. It goes by "signs in over there" now; the
password it kept is the emergency door, set by an administrator.

And the picture. The provider sends one, the server fetches it at each
sign-in and stores it encrypted in a table beside the users rather than in
them, and serves it back through the API — so the page never talks to the
provider, no third-party cookie is needed for a face to appear, and it
survives the provider being down like everything else here. Fetched once per
account into an object URL, since an img tag cannot carry a bearer token.

The suite's provider now serves a picture too, and the check asks the browser
whether it actually decoded rather than whether the element exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -14,6 +14,30 @@ a rebuild is not bit-identical.
 
 ---
 
+## 2026-08-21 — The face from the provider, and whose business a password is
+
+**Images** — web `sha256:e525b11d…`, server `sha256:95d56c46…`
+
+The server image changed: a table for profile pictures and the route that serves
+them.
+
+- **The profile picture comes along.** When the provider sends one — PocketID
+  does — the server fetches it at each sign-in and keeps it, encrypted, in a
+  table of its own rather than in `users`, where a blob would ride along with
+  every `SELECT *` for the sake of one corner of the screen. It is served back
+  through the API: nothing on the page talks to the provider, no third-party
+  cookie has to survive for a face to appear, and the picture keeps working when
+  the provider does not. It shows in the sidebar, in the account panel and beside
+  the name in the administration list, and arrives with the **next** sign-in —
+  the one moment this app speaks to the provider at all.
+- **An account that signs in through the provider has no password tab**, and that
+  now includes one that had a password before it was linked — the usual case for
+  whoever set this up, and the reason the tab was still there. The password it
+  kept is the emergency door rather than a second thing for its owner to
+  maintain: it is set by an administrator, and the account panel says so.
+
+---
+
 ## 2026-08-18 — Which accounts belong to the provider
 
 **Images** — web `sha256:5fb51ed4…`, server `sha256:ce1f4649…`