Have only one user profile editor

[jma]

Context

User identity in SONAR is currently split across two data models with two
separate editors:

1. Invenio account (User + UserProfile) — edited at
   /account/settings/profile/. Fields: full_name (single field),
   username, affiliations. This is the only profile that
   self-registered and SSO users (Switch edu-ID, ORCID) get: on
   registration/SSO, SONAR creates only an Invenio account + the user
   role — no SONAR UserRecord. The username and affiliations
   fields are not read anywhere in SONAR's business logic.

2. SONAR UserRecord resource — edited with the Angular editor at
   /users/profile. Fields: first_name, last_name, email,
   birth_date, street, postal_code, city, phone, organisation,
   role, subdivision. This is the profile of professional accounts
   (submitter/moderator/admin). organisation/role/subdivision drive
   permissions and multi-tenancy; deposits reference a UserRecord
   (deposit.user.$ref).

Having two editors is confusing and means self-registered users have an
incomplete profile.

Decision: unify on the SONAR UserRecord

The SONAR UserRecord becomes the single source of truth. The Invenio
profile editor is removed. The Invenio User remains only for
authentication (email + password + roles), kept in sync as today via
UserRecord.user / sync_roles().

What should be done

• Create a UserRecord for every user, including self-registered and
  SSO users. On first registration/SSO, populate the UserRecord from the
  available data (email + full name).
• Name handling: keep first_name / last_name (both required). When
  only a full_name is available (ORCID/edu-ID), split it heuristically
  (last token = last name, the rest = first name), pre-fill the record, and
  let the user correct it in their profile.
• Fields: keep all current UserRecord fields (including birth_date,
  address and phone). Drop the Invenio-only username and affiliations
  (unused).
• Remove the Invenio profile editor (/account/settings/profile/) and
  route all profile editing to the single Angular editor.
• Field-level access control (self-profile editing):
  • Keep the current schema-level behavior: role, organisation and
    subdivision are hidden in the form for non-privileged users (handled
    by UsersJSONSchema.process()).
  • Add an API-level guard (marshmallow loader and/or permission) so a
    user editing their own record cannot modify role, organisation or
    subdivision. Today UserPermission.update allows full self-edit with
    no field-level restriction → privilege-escalation gap via a direct
    PUT/PATCH.
  • email remains editable in self-service.

Acceptance criteria

• A self-registered / SSO user gets a UserRecord on first login
• full_name from SSO is split into first_name / last_name, editable afterwards
• Only the Angular editor remains; /account/settings/profile/ no longer used
• username and affiliations removed from the user data model
• A non-admin user cannot change their own role / organisation / subdivision via the API (returns 403 or strips the fields)
• Existing professional accounts and deposits are unaffected
• Tests cover: SSO user → UserRecord creation, name split, API field guard

Open / to verify during implementation

• Migration: backfill UserRecord for existing Invenio-only accounts (the
  self-registered/SSO users that currently have no UserRecord).
• Confirm no other code path reads the Invenio UserProfile (username,
  affiliations) before removing it.