feat(profile): self-service name/email/password + desktop installers in CI

Self-service profile: any signed-in user edits their OWN fullName/email and
changes their OWN password (proving the current one), without any user:*
permission. New routes PUT /api/auth/profile + /api/auth/password act only on
req.user.sub (cannot touch username/role), CSRF-guarded; SPA screen at /profile
reachable from the header username chip. email added to the session view +
SessionUser. 7 tests (routes/profile.test.ts); 148 server tests green.

Desktop in CI: new .gitea/workflows/build-desktop.yml builds .deb + .AppImage
on every push to dev/main and uploads them as unsigned workflow artifacts
(per-commit test build). Signed/versioned release stays on release.yml (tag v*).

Wiki: local-jwt-auth (self-service routes), desktop-shell-tauri (two-workflow CI
split), log entry.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/lib/i18n/en.ts

@@ -58,6 +58,27 @@ export const en: Catalog = {
     reports: "Reports",
     recycleBin: "Recycle bin",
     logs: "Logs",
+    profile: "Profile",
+  },
+  profile: {
+    title: "My profile",
+    accountSection: "Account",
+    fullName: "Full name",
+    fullNamePh: "First and last name",
+    email: "Email",
+    emailPh: "you@example.com",
+    username: "Username",
+    role: "Role",
+    saveProfile: "Save profile",
+    profileSaved: "Profile saved.",
+    passwordSection: "Change password",
+    currentPassword: "Current password",
+    newPassword: "New password",
+    confirmPassword: "Confirm password",
+    changePassword: "Change password",
+    passwordChanged: "Password changed.",
+    passwordsDontMatch: "Passwords don't match.",
+    passwordTooShort: "Password must be at least {{min}} characters.",
   },
   status: {
     live: "LIVE",