Backend core: user profiles, RLS security, auth trigger, and test suite

[Heer-27]

Summary

Implements the core backend services for user accounts and profiles, along with database security policies and a test suite.

Changes

• Database & security: schema for users/profiles, Row Level Security (RLS) policies, and an auth trigger for account creation
• Auth hardening: removed a hardcoded password fallback and added strict password validation (9830fcc)
• User services (user-service.ts):
  • getMyProfile — returns full profile (including email/balance) for the authenticated user
  • getPublicProfile — returns a sanitized profile for other users, without exposing email
  • updateMyProfile — updates the authenticated user's own profile
  • Server-side input validation for profile updates (name length, year bounds, etc.)
  • Enforces that a user cannot update another user's profile (returns Forbidden)
• Testing: added Vitest as the test runner (vitest.config.ts, tsconfig.json updates) with 8 tests covering validation, profile retrieval, and security enforcement — all passing
• Types: minor cleanup of type-only imports/exports in skills.ts

Testing