feat(profile): default avatars via DiceBear "thumbs" (CC0), drop boring_avatars

Replace the flutter_boring_avatars fallback with a friendly DiceBear
"thumbs" face, generated offline (dicebear_core) and deterministically
from the pubkey, rendered as SVG (flutter_svg). The thumbs style is
CC0 1.0 (public domain) — no attribution, AGPL-clean — unlike Multiavatar
whose custom licence restricts use. Style parsed once and per-pubkey SVG
memoized; the CC0 <metadata> block is stripped to keep flutter_svg quiet.

apps/app_seeds/lib/ui/avatar.dart

@@ -6,7 +6,7 @@ import 'seed_glyph.dart';
 ///    media server, like offer photos);
 ///  - `tane:seed:<name>` — one of our own seed illustrations (for people who'd
 ///    rather not put a real photo — pseudonymity stays the default);
-///  - empty — a pattern avatar generated deterministically from the pubkey.
+///  - empty — a DiceBear "thumbs" face generated deterministically from the pubkey.
 const avatarGlyphPrefix = 'tane:seed:';
 
 /// The seed illustrations offered as ready-made avatars. Names are the stable

apps/app_seeds/lib/ui/peer_avatar.dart

@@ -1,27 +1,18 @@
+import 'package:dicebear_core/dicebear_core.dart' show Avatar, Style;
+import 'package:dicebear_styles/thumbs.dart';
 import 'package:flutter/material.dart';
-import 'package:flutter_boring_avatars/flutter_boring_avatars.dart';
+import 'package:flutter_svg/flutter_svg.dart';
 
 import '../services/offer_thumbnail.dart' show decodeDataUri;
 import '../services/profile_cache.dart';
 import 'avatar.dart';
 import 'seed_glyph.dart';
-import 'theme.dart';
-
-/// Palette for the generated default avatars — earthy seed-and-leaf tones so
-/// the fallback art sits inside the app's palette rather than fighting it.
-const _generatedAvatarPalette = BoringAvatarPalette([
-  seedGreen,
-  seedRating, // warm amber
-  Color(0xFFB5541F), // terracotta pot
-  Color(0xFF6B4F2A), // seed-coat brown
-  Color(0xFFD3E8C8), // pale leaf
-]);
 
 /// A small round avatar for a person. When they've set an avatar ([picture] — a
 /// `data:` photo thumbnail or a `tane:seed:<glyph>` illustration) it's shown;
-/// otherwise it falls back to a generated pattern drawn deterministically from
+/// otherwise it falls back to a [GeneratedAvatar] drawn deterministically from
-/// their [pubkey] (boring-avatars "beam"). Same pubkey → same picture on every
+/// their [pubkey]. Same pubkey → same picture on every device, so a person
-/// device, so a person stays visually recognizable without sharing anything.
+/// stays visually recognizable without sharing anything.
 class PeerAvatar extends StatelessWidget {
   const PeerAvatar({
     required this.pubkey,
@@ -34,7 +25,7 @@ class PeerAvatar extends StatelessWidget {
   final String pubkey;
   final String? name;
 
-  /// The person's chosen avatar value; null/empty → the coloured-initial disc.
+  /// The person's chosen avatar value; null/empty → the [GeneratedAvatar].
   final String? picture;
   final double radius;
 
@@ -58,16 +49,52 @@ class PeerAvatar extends StatelessWidget {
       }
     }
 
+    return GeneratedAvatar(pubkey: pubkey, name: name, radius: radius);
+  }
+}
+
+/// The `thumbs` DiceBear style, parsed once — [Style.parse] validates the style
+/// definition against its schema, which is not free to repeat per build.
+final _thumbsStyle = Style.parse(thumbs);
+
+/// Rendered-SVG memo keyed by pubkey, so a person's avatar is generated once and
+/// reused across every rebuild and list row rather than re-rendered each time.
+final _svgCache = <String, String>{};
+
+/// Strips the `<metadata>` block (the style's CC0 licence notice) that
+/// flutter_svg cannot parse and logs a warning for; CC0 requires no attribution
+/// in the rendered image, and the licence still ships with the package source.
+final _metadataElement = RegExp(r'<metadata\b[^>]*>.*?</metadata>', dotAll: true);
+
+String _renderThumbs(String pubkey) =>
+    Avatar(_thumbsStyle, {'seed': pubkey}).svg.replaceAll(_metadataElement, '');
+
+/// The deterministic default avatar for a person with no chosen [picture]: a
+/// friendly DiceBear "thumbs" face (CC0) seeded from their [pubkey], so the same
+/// key yields the same face on every device with nothing shared. Rendered as an
+/// SVG (no network, no assets). Exposes [pubkey] so call sites/tests can find it.
+class GeneratedAvatar extends StatelessWidget {
+  const GeneratedAvatar({
+    required this.pubkey,
+    this.name,
+    this.radius = 14,
+    super.key,
+  });
+
+  final String pubkey;
+  final String? name;
+  final double radius;
+
+  @override
+  Widget build(BuildContext context) {
+    final svg = _svgCache[pubkey] ??= _renderThumbs(pubkey);
     return Semantics(
       label: name,
       image: true,
+      child: ClipOval(
         child: SizedBox.square(
           dimension: radius * 2,
-        child: BoringAvatar(
+          child: SvgPicture.string(svg, fit: BoxFit.cover),
-          name: pubkey,
-          type: BoringAvatarType.beam,
-          palette: _generatedAvatarPalette,
-          shape: const OvalBorder(),
         ),
       ),
     );

apps/app_seeds/pubspec.yaml

@@ -78,7 +78,9 @@ dependencies:
   # while the app is foregrounded. Mobile/Linux/macOS only; a no-op on web and
   # Windows. Foreground-only by design — background/push is a later concern.
   flutter_local_notifications: ^18.0.1
-  flutter_boring_avatars: ^2.1.0
+  dicebear_core: ^10.3.0
+  dicebear_styles: ^10.2.0
+  flutter_svg: ^2.3.0
 
 dev_dependencies:
   flutter_test:

apps/app_seeds/test/ui/chat_message_list_test.dart

@@ -3,7 +3,6 @@ import 'dart:async';
 import 'package:commons_core/commons_core.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_bloc/flutter_bloc.dart';
-import 'package:flutter_boring_avatars/flutter_boring_avatars.dart';
 import 'package:flutter_localizations/flutter_localizations.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:tane/domain/chat_timeline.dart';
@@ -129,10 +128,10 @@ void main() {
     // so you can tell who said what at a glance.
     expect(find.byType(PeerAvatar), findsNWidgets(2));
     final generated = tester
-        .widgetList<BoringAvatar>(find.byType(BoringAvatar))
+        .widgetList<GeneratedAvatar>(find.byType(GeneratedAvatar))
         .toList();
     expect(generated, hasLength(2));
-    expect(generated.first.name, isNot(generated.last.name));
+    expect(generated.first.pubkey, isNot(generated.last.pubkey));
   });
 
   testWidgets('a new message lands in view at the bottom, not below the fold', (

apps/app_seeds/test/ui/peer_avatar_test.dart

@@ -1,5 +1,4 @@
 import 'package:flutter/material.dart';
-import 'package:flutter_boring_avatars/flutter_boring_avatars.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:tane/services/profile_cache.dart';
 import 'package:tane/ui/avatar.dart';
@@ -38,18 +37,19 @@ void main() {
       home: Scaffold(body: Center(child: child)),
     );
 
-    testWidgets('falls back to a generated pattern keyed by pubkey', (
+    testWidgets('falls back to a generated avatar keyed by pubkey', (
       tester,
     ) async {
       await tester.pumpWidget(host(PeerAvatar(pubkey: 'aa', name: 'rosa')));
-      final generated = tester.widget<BoringAvatar>(find.byType(BoringAvatar));
+      final generated =
-      expect(generated.name, 'aa'); // pubkey, not name → stable across renames
+          tester.widget<GeneratedAvatar>(find.byType(GeneratedAvatar));
+      expect(generated.pubkey, 'aa'); // pubkey, not name → stable across renames
       expect(find.byType(Text), findsNothing);
     });
 
     testWidgets('generates it even when the name is unknown', (tester) async {
       await tester.pumpWidget(host(const PeerAvatar(pubkey: 'aa')));
-      expect(find.byType(BoringAvatar), findsOneWidget);
+      expect(find.byType(GeneratedAvatar), findsOneWidget);
     });
 
     testWidgets('renders a seed illustration when the avatar is a token', (
@@ -76,19 +76,19 @@ void main() {
       expect(find.byType(SeedGlyph), findsOneWidget);
     });
 
-    testWidgets('falls back to the generated pattern when nothing is cached', (
+    testWidgets('falls back to the generated avatar when nothing is cached', (
       tester,
     ) async {
       final cache = ProfileCache(InMemorySecretStore());
       await tester.pumpWidget(host(
           CachedAvatar(pubkey: 'peer2', name: 'Bea', cache: cache)));
       await tester.pumpAndSettle();
-      expect(find.byType(BoringAvatar), findsOneWidget);
+      expect(find.byType(GeneratedAvatar), findsOneWidget);
     });
 
-    testWidgets('no cache → the generated pattern', (tester) async {
+    testWidgets('no cache → the generated avatar', (tester) async {
       await tester.pumpWidget(host(const CachedAvatar(pubkey: 'x', name: 'Bea')));
-      expect(find.byType(BoringAvatar), findsOneWidget);
+      expect(find.byType(GeneratedAvatar), findsOneWidget);
     });
   });
 }

pubspec.lock

@@ -297,6 +297,30 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "0.7.14"
+  dicebear_core:
+    dependency: transitive
+    description:
+      name: dicebear_core
+      sha256: "7a38725ed8895feeeb6d34a6a0946322a03649077fa49f9a711530e035fb53f2"
+      url: "https://pub.dev"
+    source: hosted
+    version: "10.3.0"
+  dicebear_schema:
+    dependency: transitive
+    description:
+      name: dicebear_schema
+      sha256: dfbaa477e4e7ed1500ae8f0263ecf7db3081c492489b817a401a52e21e0ace9c
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.0"
+  dicebear_styles:
+    dependency: transitive
+    description:
+      name: dicebear_styles
+      sha256: "4761fc26da7eb12b5b499be4efbd7cadc9186e301095199bbf424a3150bcd866"
+      url: "https://pub.dev"
+    source: hosted
+    version: "10.2.0"
   drift:
     dependency: transitive
     description:
@@ -414,14 +438,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "9.1.1"
-  flutter_boring_avatars:
-    dependency: transitive
-    description:
-      name: flutter_boring_avatars
-      sha256: c4439a5e6753db58debd8d85a92e9747727e5f5c05cc1f3a252ba70d2c1df720
-      url: "https://pub.dev"
-    source: hosted
-    version: "2.1.0"
   flutter_driver:
     dependency: transitive
     description: flutter
@@ -536,6 +552,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "3.1.2"
+  flutter_svg:
+    dependency: transitive
+    description:
+      name: flutter_svg
+      sha256: "35882981abcbfb8c15b286f0cd690ff25bac12d95eff3e25ee207f37d4c42e7f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.0"
   flutter_tesseract_ocr:
     dependency: transitive
     description:
@@ -812,6 +836,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "4.12.0"
+  json_schema:
+    dependency: transitive
+    description:
+      name: json_schema
+      sha256: f37d9c3fdfe8c9aae55fdfd5af815d24ce63c3a0f6a2c1f0982c30f43643fa1a
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.2.2"
   leak_tracker:
     dependency: transitive
     description:
@@ -1124,6 +1156,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "3.0.2"
+  quiver:
+    dependency: transitive
+    description:
+      name: quiver
+      sha256: ea0b925899e64ecdfbf9c7becb60d5b50e706ade44a85b2363be2a22d88117d2
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.2"
   recase:
     dependency: transitive
     description:
@@ -1140,6 +1180,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "0.6.0"
+  rfc_6901:
+    dependency: transitive
+    description:
+      name: rfc_6901
+      sha256: "6a43b1858dca2febaf93e15639aa6b0c49ccdfd7647775f15a499f872b018154"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.1"
   serial_csv:
     dependency: transitive
     description:
@@ -1361,6 +1409,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.3.1"
+  uri:
+    dependency: transitive
+    description:
+      name: uri
+      sha256: "889eea21e953187c6099802b7b4cf5219ba8f3518f604a1033064d45b1b8268a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
   url_launcher:
     dependency: transitive
     description:
@@ -1433,6 +1489,30 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "4.5.3"
+  vector_graphics:
+    dependency: transitive
+    description:
+      name: vector_graphics
+      sha256: "2306c03da2ba81724afeb589c351ebbc0aa7d86005925be8f8735856dbe5e42d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.2"
+  vector_graphics_codec:
+    dependency: transitive
+    description:
+      name: vector_graphics_codec
+      sha256: "99fd9fbd34d9f9a32efd7b6a6aae14125d8237b10403b422a6a6dfeac2806146"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.13"
+  vector_graphics_compiler:
+    dependency: transitive
+    description:
+      name: vector_graphics_compiler
+      sha256: "142a9146f447d15b10bdc00e21d5f4d83e5b32bb5f8f8f5a04c75311344923a3"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.6"
   vector_math:
     dependency: transitive
     description: