Hold down the place the picture is looked for

The suite proved a picture was drawn somewhere on the page. Where it belongs
is the account button at the top of the sidebar — the person icon's place —
so that is what the check now names.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

e2e/oidc.mjs

@@ -101,6 +101,13 @@ try {
   check(created?.signsInWithProvider === true, "and has no password of its own");
   check(created?.linkedToProvider === true, "and is marked as belonging to the provider");
 
+  /* The picture belongs where the person icon was: in the account button at the
+     top of the sidebar. That is the place it is looked for. */
+  check(
+    (await page.locator('[title="Account"] [data-avatar]').count()) === 1,
+    "the account button in the sidebar wears the picture instead of the person icon"
+  );
+
   /* ── what the two people involved see ──
    * The one signing in: no password tab, because there is no password behind
    * it. The administrator: which accounts these are, without asking anybody. */

readme.md

@@ -593,7 +593,7 @@ docker compose -f docker-compose.dev.yml up -d --build   # must be running
 | Suite | Checks | What it holds down |
 | --- | --- | --- |
 | `admin` | 15 | no sign-up anywhere; `/api/admin/*` refused for non-admins even when called directly |
-| `oidc` | 39 | the whole redirect journey against a provider that signs real tokens — and the four ways it must fail: a refusal, a replayed ticket, a token signed with an unpublished key, a token addressed to another client |
+| `oidc` | 40 | the whole redirect journey against a provider that signs real tokens — and the four ways it must fail: a refusal, a replayed ticket, a token signed with an unpublished key, a token addressed to another client |
 | `editor` | 40 | tables and their right-click menu, task lists, note links, backlinks — and that each survives a reload |
 | `search-attachments` | 12 | body-only matches, ranking, umlauts; images as blob URLs, not inline bytes |
 | `history` | 10 | a large deletion is snapshotted, restoring works, restoring is itself undoable |