Fill in a name and photo from a Google ID token

Posts the raw Google ID token minted by the sign-in button. The server verifies the signature with Google, checks the audience is Result's own client and that the token's email matches the session, then fills in the profile's display name and avatar ONLY where they are still empty — a name typed in Settings is never overwritten by a later sign-in. Returns the resulting values whether or not anything was written.