feat: per-profile DEKs + multi-profile (Phase A2, #3)

Implements the 3-tier key model from the multi-person sharing ADR:
each account owns multiple profiles (a person or pet — a 'subject of
care'), and each profile has its own random AES-256-GCM DEK. All
health data is now encrypted under the active profile's DEK, not the
account-wide DEK. The account DEK wraps each profile DEK; the server
stores only opaque wrapped blobs.

Per the ADR: DB wipe, no migration (no real user data). This unblocks
Phase B (sharing) — there is now a per-profile key to wrap to a
recipient's X25519 public key.

Backend:
- Profile model: owner_account_id, kind (human/pet), relationship,
  wrapped_profile_dek + iv. ProfileRepository gains find_all_by_owner,
  find_by_profile_id_owned, update_profile, delete_profile — all
  ownership-scoped.
- Profile handlers: GET/POST /api/profiles, GET/PUT/DELETE
  /api/profiles/:id. Removed /api/profiles/me. Renamed users.rs
  get_profile/update_profile (the /api/users/me handlers) to
  get_account/update_account to resolve a name collision.
- Register accepts default_profile_* fields and auto-creates the self
  profile when the client provides a wrapped profile DEK.
- HealthStatistic + Appointment gain profile_id and ?profile_id=
  filtering (health stats previously had no profile binding).
- New profile_tests.rs: multi-profile CRUD + ownership isolation +
  register-with-default-profile. Fixed the zk health-stat test to
  send the now-required profile_id.

Frontend:
- crypto/keys.ts: generateProfileDek, wrapProfileDek, unwrapProfileDek
  + in-memory per-profile DEK store with an active-profile concept.
- useProfileStore rewritten: holds profiles[], activeProfileId;
  loadProfiles unwraps each profile DEK; create/update/delete. All 11
  encrypt/decrypt sites switched from getEncKey() to
  getActiveProfileDek(). load actions pass ?profile_id= so only the
  active profile's rows come back.
- ProfileEditor rewritten for the new store (edit active profile,
  create/delete). New ProfileSwitcher in the Dashboard AppBar.
- MedicationManager / AppointmentsManager use the active profile id
  instead of the hardcoded profile_<user_id>.
- 2 new crypto tests for per-profile DEK isolation; updated store +
  component tests for the active-profile-DEK model.

Verification: backend cargo build/clippy/fmt green, tests compile
(integration tests run in CI — Mongo is fixed there). Frontend
tsc clean, 30/30 tests pass.

Closes nothing yet (Phase B/C/D remain). Refs #3.

backend/src/handlers/health_stats.rs

@@ -3,7 +3,7 @@ use crate::config::AppState;
 use crate::models::health_stats::{HealthStatResponse, HealthStatistic};
 use crate::models::medication::EncryptedFieldWire;
 use axum::{
-    extract::{Path, State},
+    extract::{Path, Query, State},
     http::StatusCode,
     response::IntoResponse,
     Extension, Json,
@@ -14,9 +14,16 @@ use serde::Deserialize;
 #[derive(Debug, Deserialize)]
 pub struct CreateHealthStatRequest {
     pub encrypted_data: EncryptedFieldWire,
+    /// Which profile this stat belongs to.
+    pub profile_id: String,
     pub recorded_at: Option<String>,
 }
 
+#[derive(Debug, Deserialize, Default)]
+pub struct ListHealthStatsQuery {
+    pub profile_id: Option<String>,
+}
+
 #[derive(Debug, Deserialize)]
 pub struct UpdateHealthStatRequest {
     pub encrypted_data: EncryptedFieldWire,
@@ -41,6 +48,7 @@ pub async fn create_health_stat(
     let stat = HealthStatistic {
         id: None,
         user_id: claims.sub.clone(),
+        profile_id: req.profile_id,
         encrypted_data: req.encrypted_data,
         recorded_at: req
             .recorded_at
@@ -70,6 +78,7 @@ pub async fn create_health_stat(
 pub async fn list_health_stats(
     State(state): State<AppState>,
     Extension(claims): Extension<Claims>,
+    Query(query): Query<ListHealthStatsQuery>,
 ) -> impl IntoResponse {
     let repo = match state.health_stats_repo.as_ref() {
         Some(r) => r,
@@ -81,7 +90,10 @@ pub async fn list_health_stats(
                 .into_response()
         }
     };
-    match repo.find_by_user(&claims.sub).await {
+    match repo
+        .find_by_user_filtered(&claims.sub, query.profile_id.as_deref())
+        .await
+    {
         Ok(stats) => {
             let resp: Vec<HealthStatResponse> = stats.into_iter().map(Into::into).collect();
             (StatusCode::OK, Json(resp)).into_response()