feat: per-profile DEKs + multi-profile (Phase A2, #3)

Implements the 3-tier key model from the multi-person sharing ADR:
each account owns multiple profiles (a person or pet — a 'subject of
care'), and each profile has its own random AES-256-GCM DEK. All
health data is now encrypted under the active profile's DEK, not the
account-wide DEK. The account DEK wraps each profile DEK; the server
stores only opaque wrapped blobs.

Per the ADR: DB wipe, no migration (no real user data). This unblocks
Phase B (sharing) — there is now a per-profile key to wrap to a
recipient's X25519 public key.

Backend:
- Profile model: owner_account_id, kind (human/pet), relationship,
  wrapped_profile_dek + iv. ProfileRepository gains find_all_by_owner,
  find_by_profile_id_owned, update_profile, delete_profile — all
  ownership-scoped.
- Profile handlers: GET/POST /api/profiles, GET/PUT/DELETE
  /api/profiles/:id. Removed /api/profiles/me. Renamed users.rs
  get_profile/update_profile (the /api/users/me handlers) to
  get_account/update_account to resolve a name collision.
- Register accepts default_profile_* fields and auto-creates the self
  profile when the client provides a wrapped profile DEK.
- HealthStatistic + Appointment gain profile_id and ?profile_id=
  filtering (health stats previously had no profile binding).
- New profile_tests.rs: multi-profile CRUD + ownership isolation +
  register-with-default-profile. Fixed the zk health-stat test to
  send the now-required profile_id.

Frontend:
- crypto/keys.ts: generateProfileDek, wrapProfileDek, unwrapProfileDek
  + in-memory per-profile DEK store with an active-profile concept.
- useProfileStore rewritten: holds profiles[], activeProfileId;
  loadProfiles unwraps each profile DEK; create/update/delete. All 11
  encrypt/decrypt sites switched from getEncKey() to
  getActiveProfileDek(). load actions pass ?profile_id= so only the
  active profile's rows come back.
- ProfileEditor rewritten for the new store (edit active profile,
  create/delete). New ProfileSwitcher in the Dashboard AppBar.
- MedicationManager / AppointmentsManager use the active profile id
  instead of the hardcoded profile_<user_id>.
- 2 new crypto tests for per-profile DEK isolation; updated store +
  component tests for the active-profile-DEK model.

Verification: backend cargo build/clippy/fmt green, tests compile
(integration tests run in CI — Mongo is fixed there). Frontend
tsc clean, 30/30 tests pass.

Closes nothing yet (Phase B/C/D remain). Refs #3.

web/normogen-web/src/crypto/crypto.e2e.test.ts

@@ -6,6 +6,8 @@ import {
   rewrapDek,
   encryptJson,
   decryptJson,
+  encrypt,
+  decrypt,
   setEncKey,
   clearEncKey,
   hasEncKey,
@@ -15,6 +17,12 @@ import {
   setIdentityPrivate,
   clearIdentityPrivate,
   hasIdentityPrivate,
+  generateProfileDek,
+  wrapProfileDek,
+  unwrapProfileDek,
+  setProfileDek,
+  getProfileDek,
+  clearProfileDeks,
 } from './index';
 
 /** X25519 in Web Crypto is a recent addition (Node 16+, modern browsers). Some
@@ -224,3 +232,53 @@ describe('account X25519 identity keypair (Phase A1)', () => {
     expect(aHex).not.toBe(bHex);
   });
 });
+
+describe('per-profile DEK isolation (Phase A2)', () => {
+  const password = 'my-secret-password';
+
+  it('two profiles get distinct DEKs, each wrapped under the account DEK', async () => {
+    // One account DEK (unlocked from the password).
+    const setup = await setupEncryption(password);
+    const accountDek = setup.dek;
+
+    // Two profiles, each with its own random DEK.
+    const childDek = await generateProfileDek();
+    const petDek = await generateProfileDek();
+
+    // Each profile DEK is wrapped under the account DEK for storage.
+    const childWrapped = await wrapProfileDek(childDek, accountDek);
+    const petWrapped = await wrapProfileDek(petDek, accountDek);
+
+    // Both wrapped blobs decrypt cleanly under the account DEK.
+    const childUnwrapped = await unwrapProfileDek(childWrapped, accountDek);
+    const petUnwrapped = await unwrapProfileDek(petWrapped, accountDek);
+    expect(childUnwrapped).toBeDefined();
+    expect(petUnwrapped).toBeDefined();
+
+    // Data encrypted under the child profile's DEK cannot be decrypted by the
+    // pet profile's DEK (and vice versa) — this is the per-profile isolation
+    // guarantee that makes the parent/child and pet cases safe.
+    const childData = await encrypt('child-medication', childDek);
+    await expect(decrypt(childData, petDek)).rejects.toThrow();
+    const petData = await encrypt('pet-weight', petDek);
+    await expect(decrypt(petData, childDek)).rejects.toThrow();
+
+    // ...but each decrypts with its own key.
+    expect(await decrypt(childData, childDek)).toBe('child-medication');
+    expect(await decrypt(petData, petDek)).toBe('pet-weight');
+  });
+
+  it('the in-memory profile-DEK store maps profile ids to DEKs', async () => {
+    const childDek = await generateProfileDek();
+    const petDek = await generateProfileDek();
+    setProfileDek('profile_child', childDek);
+    setProfileDek('profile_pet', petDek);
+    // Each id resolves to the DEK that was stored under it; unknown ids resolve to null.
+    expect(getProfileDek('profile_child')).toBe(childDek);
+    expect(getProfileDek('profile_pet')).toBe(petDek);
+    expect(getProfileDek('profile_unknown')).toBeNull();
+    // Clearing drops everything.
+    clearProfileDeks();
+    expect(getProfileDek('profile_child')).toBeNull();
+  });
+});