Make admin creation upgrade-safe and drop deprecated avatar options

- "generate admin user" handler also fires on version upgrades; tolerate
  an existing admin and hide the password from logs (no_log)
- remove [picture] DISABLE_GRAVATAR / ENABLE_FEDERATED_AVATAR, which
  Gitea >= 1.23 ignores (moved to the admin panel)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

handlers/main.yml

@@ -16,3 +16,8 @@
       --work-path {{ gitea_data_location }}
   become: yes
   become_user: "{{ gitea_usr }}"
+  register: gitea_admin_create
+  # handler also fires on version upgrades; an existing admin is fine
+  failed_when: gitea_admin_create.rc != 0 and 'user already exists' not in gitea_admin_create.stderr
+  changed_when: gitea_admin_create.rc == 0
+  no_log: true

templates/opt/gitea/home/app.ini.j2

@@ -58,10 +58,6 @@ DEFAULT_ALLOW_CREATE_ORGANIZATION = true
 DEFAULT_ENABLE_TIMETRACKING       = true
 NO_REPLY_ADDRESS                  = noreply.{{ gitea_ssh_domain }}
 
-[picture]
-DISABLE_GRAVATAR        = false
-ENABLE_FEDERATED_AVATAR = true
-
 [openid]
 ENABLE_OPENID_SIGNIN = false
 ENABLE_OPENID_SIGNUP = false