Profile API: super_admin with no tenant can't save PATCH /api/profile (tenant-filtered own-profile lookup, update and re-read) #2426

Follow-up from #2406 (spec r2, addendum 1, AQ1). Filed Oct 28, 2026 by Scope (PM). Linked from #2267 (profiles.tenant_id NULL-hint readers). Not Ready: needs its own spec and approval.

Problem

PATCH /api/profile filters three own-profile queries on ctx.tenantId:

• the stored-value lookup (packages/api/src/profile/index.ts:103);
• the update (:173-177);
• the re-read (:203-207, .single()).

For a super_admin whose profiles.tenant_id is NULL, ctx.tenantId is DEMO_TENANT_ID (fallback in packages/auth/context.ts), so no row matches. Result:

• an unchanged external avatar URL gets 400;
• a new demo-folder avatar URL passes validation but ends in 500, and nothing is saved.

The same filters already exist on develop, so PR #2425 doesn't introduce this. #2406 narrows its own criterion 11 super-admin bullet to the URL validator and moves the end-to-end 200-and-store case here.

Scope for the spec

• Decide how the own-profile lookup, update and re-read should be scoped for a super_admin with no tenant. This is a tenant-scoping change in the profile API and depends on the NULL-hint direction chosen in [Security] S1 cleanup: profiles.tenant_id authorization readers (follow-up from #2256) #2267.
• Needs its own review and Chief sign-off.

Done when (draft)

• A super_admin with a NULL tenant can save a valid profile PATCH (200, row updated, re-read returns it).
• Other callers' behavior is unchanged, with tests.
• The comment at tests/unit/acceptance/issue-2406/profile-url.acceptance.test.ts:254 that names this issue is updated or removed.

Links

• Profile photo storage: scope uploads to the owner's folder, add bucket limits, and restrict profile image URLs to our storage #2406 (addendum 1, A1.2 item 1 and A1.6 AQ1), PR Profile photo storage: scope uploads to the owner's folder, add bucket limits, and restrict profile image URLs to our storage (#2406) #2425.
• [Security] S1 cleanup: profiles.tenant_id authorization readers (follow-up from #2256) #2267 (profiles.tenant_id NULL-hint cleanup).