feat: per-profile DEKs + multi-profile (Phase A2, #3)

Implements the 3-tier key model from the multi-person sharing ADR:
each account owns multiple profiles (a person or pet — a 'subject of
care'), and each profile has its own random AES-256-GCM DEK. All
health data is now encrypted under the active profile's DEK, not the
account-wide DEK. The account DEK wraps each profile DEK; the server
stores only opaque wrapped blobs.

Per the ADR: DB wipe, no migration (no real user data). This unblocks
Phase B (sharing) — there is now a per-profile key to wrap to a
recipient's X25519 public key.

Backend:
- Profile model: owner_account_id, kind (human/pet), relationship,
  wrapped_profile_dek + iv. ProfileRepository gains find_all_by_owner,
  find_by_profile_id_owned, update_profile, delete_profile — all
  ownership-scoped.
- Profile handlers: GET/POST /api/profiles, GET/PUT/DELETE
  /api/profiles/:id. Removed /api/profiles/me. Renamed users.rs
  get_profile/update_profile (the /api/users/me handlers) to
  get_account/update_account to resolve a name collision.
- Register accepts default_profile_* fields and auto-creates the self
  profile when the client provides a wrapped profile DEK.
- HealthStatistic + Appointment gain profile_id and ?profile_id=
  filtering (health stats previously had no profile binding).
- New profile_tests.rs: multi-profile CRUD + ownership isolation +
  register-with-default-profile. Fixed the zk health-stat test to
  send the now-required profile_id.

Frontend:
- crypto/keys.ts: generateProfileDek, wrapProfileDek, unwrapProfileDek
  + in-memory per-profile DEK store with an active-profile concept.
- useProfileStore rewritten: holds profiles[], activeProfileId;
  loadProfiles unwraps each profile DEK; create/update/delete. All 11
  encrypt/decrypt sites switched from getEncKey() to
  getActiveProfileDek(). load actions pass ?profile_id= so only the
  active profile's rows come back.
- ProfileEditor rewritten for the new store (edit active profile,
  create/delete). New ProfileSwitcher in the Dashboard AppBar.
- MedicationManager / AppointmentsManager use the active profile id
  instead of the hardcoded profile_<user_id>.
- 2 new crypto tests for per-profile DEK isolation; updated store +
  component tests for the active-profile-DEK model.

Verification: backend cargo build/clippy/fmt green, tests compile
(integration tests run in CI — Mongo is fixed there). Frontend
tsc clean, 30/30 tests pass.

Closes nothing yet (Phase B/C/D remain). Refs #3.

web/normogen-web/src/crypto/keys.ts

@@ -114,6 +114,39 @@ export async function rewrapDek(
   return wrapDek(dek, newKek);
 }
 
+// ---------------------------------------------------------------------------
+// Per-profile DEK wrap/unwrap (Phase A2).
+//
+// Each profile owns a random AES-256-GCM DEK that encrypts all of that
+// profile's data. The profile DEK is wrapped under the *account* DEK (not a
+// KEK derived from a secret) and stored on the server. At login/unlock the
+// client unwraps each profile DEK using the account DEK. See
+// docs/adr/multi-person-sharing.md §1.
+// ---------------------------------------------------------------------------
+
+/** Generate a fresh random profile DEK (a random AES-256-GCM key). */
+export async function generateProfileDek(): Promise<CryptoKey> {
+  return generateDek();
+}
+
+/** Wrap a profile DEK under the account DEK. The account DEK is a CryptoKey
+ * usable for AES-GCM encrypt/decrypt, so it serves directly as the wrap key. */
+export async function wrapProfileDek(
+  profileDek: CryptoKey,
+  accountDek: CryptoKey,
+): Promise<CipherPayload> {
+  return wrapDek(profileDek, accountDek);
+}
+
+/** Unwrap a profile DEK from its account-wrapped form. Inverse of
+ * wrapProfileDek. Throws on tamper / wrong account DEK. */
+export async function unwrapProfileDek(
+  payload: CipherPayload,
+  accountDek: CryptoKey,
+): Promise<CryptoKey> {
+  return unwrapDek(payload, accountDek);
+}
+
 // ---------------------------------------------------------------------------
 // High-level flows
 // ---------------------------------------------------------------------------
@@ -287,6 +320,43 @@ export function hasIdentityPrivate(): boolean {
   return currentIdentityPrivate !== null;
 }
 
+// ---------------------------------------------------------------------------
+// In-memory per-profile DEK store (Phase A2). One DEK per profile, plus a
+// notion of the "active" profile whose DEK encrypts/decrypts the data the UI
+// is currently showing. Same lifecycle as the account DEK: rebuilt from the
+// server-stored wrapped forms on unlock, cleared on logout.
+// ---------------------------------------------------------------------------
+
+const profileDeks: Map<string, CryptoKey> = new Map();
+let activeProfileId: string | null = null;
+
+export function setProfileDek(profileId: string, dek: CryptoKey): void {
+  profileDeks.set(profileId, dek);
+}
+
+export function getProfileDek(profileId: string): CryptoKey | null {
+  return profileDeks.get(profileId) ?? null;
+}
+
+export function setActiveProfileId(profileId: string): void {
+  activeProfileId = profileId;
+}
+
+export function getActiveProfileId(): string | null {
+  return activeProfileId;
+}
+
+/** The active profile's DEK — the key all encrypt/decrypt call sites use. */
+export function getActiveProfileDek(): CryptoKey | null {
+  if (activeProfileId === null) return null;
+  return profileDeks.get(activeProfileId) ?? null;
+}
+
+export function clearProfileDeks(): void {
+  profileDeks.clear();
+  activeProfileId = null;
+}
+
 // ---------------------------------------------------------------------------
 // Backward compat: the old deriveAuthAndEncKeys (Phase 1 direct-from-password
 // enc key). Kept for tests; new code uses setupEncryption/unlockWithPassword.