feat: per-profile DEKs + multi-profile (Phase A2, #3)

Implements the 3-tier key model from the multi-person sharing ADR:
each account owns multiple profiles (a person or pet — a 'subject of
care'), and each profile has its own random AES-256-GCM DEK. All
health data is now encrypted under the active profile's DEK, not the
account-wide DEK. The account DEK wraps each profile DEK; the server
stores only opaque wrapped blobs.

Per the ADR: DB wipe, no migration (no real user data). This unblocks
Phase B (sharing) — there is now a per-profile key to wrap to a
recipient's X25519 public key.

Backend:
- Profile model: owner_account_id, kind (human/pet), relationship,
  wrapped_profile_dek + iv. ProfileRepository gains find_all_by_owner,
  find_by_profile_id_owned, update_profile, delete_profile — all
  ownership-scoped.
- Profile handlers: GET/POST /api/profiles, GET/PUT/DELETE
  /api/profiles/:id. Removed /api/profiles/me. Renamed users.rs
  get_profile/update_profile (the /api/users/me handlers) to
  get_account/update_account to resolve a name collision.
- Register accepts default_profile_* fields and auto-creates the self
  profile when the client provides a wrapped profile DEK.
- HealthStatistic + Appointment gain profile_id and ?profile_id=
  filtering (health stats previously had no profile binding).
- New profile_tests.rs: multi-profile CRUD + ownership isolation +
  register-with-default-profile. Fixed the zk health-stat test to
  send the now-required profile_id.

Frontend:
- crypto/keys.ts: generateProfileDek, wrapProfileDek, unwrapProfileDek
  + in-memory per-profile DEK store with an active-profile concept.
- useProfileStore rewritten: holds profiles[], activeProfileId;
  loadProfiles unwraps each profile DEK; create/update/delete. All 11
  encrypt/decrypt sites switched from getEncKey() to
  getActiveProfileDek(). load actions pass ?profile_id= so only the
  active profile's rows come back.
- ProfileEditor rewritten for the new store (edit active profile,
  create/delete). New ProfileSwitcher in the Dashboard AppBar.
- MedicationManager / AppointmentsManager use the active profile id
  instead of the hardcoded profile_<user_id>.
- 2 new crypto tests for per-profile DEK isolation; updated store +
  component tests for the active-profile-DEK model.

Verification: backend cargo build/clippy/fmt green, tests compile
(integration tests run in CI — Mongo is fixed there). Frontend
tsc clean, 30/30 tests pass.

Closes nothing yet (Phase B/C/D remain). Refs #3.

web/normogen-web/src/components/profile/ProfileSwitcher.tsx

@@ -0,0 +1,49 @@
+import { useEffect, type FC } from 'react';
+import { Box, CircularProgress, MenuItem, Select, Typography } from '@mui/material';
+import { useProfileStore } from '../../store/useStore';
+
+/** A compact dropdown for switching the active profile (the subject of care
+ *  whose data the dashboard shows). Sits in the AppBar. Triggers `loadProfiles`
+ *  on mount so the list + per-profile DEKs are ready. */
+export const ProfileSwitcher: FC = () => {
+  const { profiles, activeProfileId, isLoading, loadProfiles, setActiveProfile } =
+    useProfileStore();
+
+  useEffect(() => {
+    loadProfiles();
+  }, [loadProfiles]);
+
+  if (profiles.length === 0) {
+    return isLoading ? (
+      <Box sx={{ display: 'flex', alignItems: 'center' }}>
+        <CircularProgress size={18} sx={{ color: 'common.white' }} />
+      </Box>
+    ) : (
+      <Typography variant="body2" sx={{ opacity: 0.7, mr: 2 }}>
+        No profile
+      </Typography>
+    );
+  }
+
+  return (
+    <Select
+      size="small"
+      value={activeProfileId ?? ''}
+      onChange={(e) => setActiveProfile(e.target.value)}
+      sx={{
+        mr: 2,
+        color: 'common.white',
+        '.MuiOutlinedInput-notchedOutline': { borderColor: 'rgba(255,255,255,0.5)' },
+        '.MuiSvgIcon-root': { color: 'common.white' },
+      }}
+    >
+      {profiles.map((p) => (
+        <MenuItem key={p.profile_id} value={p.profile_id}>
+          {p.name || p.relationship || p.profile_id}
+        </MenuItem>
+      ))}
+    </Select>
+  );
+};
+
+export default ProfileSwitcher;