After OAuth callback, engine.js calls profile.php?action=ensure which
creates or updates the profile using Google's user_metadata (full_name,
avatar_url). Existing profiles with default "Player" name or missing
avatars get updated on next login.

Also backfilled avatar_url and display_name for existing Google users.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>