fix(api): handle null picture (#60468)

api/prisma/schema.prisma

@@ -138,7 +138,7 @@ model user {
   newEmail                       String? // Null | Undefined
   partiallyCompletedChallenges   PartiallyCompletedChallenge[] // Undefined | PartiallyCompletedChallenge[]
   password                       String? // Undefined
-  picture                        String
+  picture                        String?
   portfolio                      Portfolio[]
   profileUI                      ProfileUI? // Undefined
   progressTimestamps             Json? // ProgressTimestamp[] | Null[] | Int64[] | Double[] - TODO: NORMALIZE

api/src/routes/protected/user.ts

@@ -648,6 +648,7 @@ export const userGetRoutes: FastifyPluginCallbackTypebox = (
             [username]: {
               ...removeNulls(publicUser),
               ...normalizeFlags(flags),
+              picture: publicUser.picture ?? '',
               currentChallengeId: currentChallengeId ?? '',
               completedChallenges: normalizeChallenges(completedChallenges),
               completedChallengeCount: completedChallenges.length,

api/src/routes/public/user.ts

@@ -191,6 +191,7 @@ export const userPublicGetRoutes: FastifyPluginCallbackTypebox = (
           ...removeNulls(publicUser),
           ...normalizeFlags(flags),
           ...sharedUser,
+          picture: user.picture ?? '',
           profileUI: normalizedProfileUI,
           // TODO: should this always be returned? Shouldn't some privacy
           // setting control it? Same applies to website, githubProfile,