feat: per-profile DEKs + multi-profile (Phase A2, #3)

Implements the 3-tier key model from the multi-person sharing ADR:
each account owns multiple profiles (a person or pet — a 'subject of
care'), and each profile has its own random AES-256-GCM DEK. All
health data is now encrypted under the active profile's DEK, not the
account-wide DEK. The account DEK wraps each profile DEK; the server
stores only opaque wrapped blobs.

Per the ADR: DB wipe, no migration (no real user data). This unblocks
Phase B (sharing) — there is now a per-profile key to wrap to a
recipient's X25519 public key.

Backend:
- Profile model: owner_account_id, kind (human/pet), relationship,
  wrapped_profile_dek + iv. ProfileRepository gains find_all_by_owner,
  find_by_profile_id_owned, update_profile, delete_profile — all
  ownership-scoped.
- Profile handlers: GET/POST /api/profiles, GET/PUT/DELETE
  /api/profiles/:id. Removed /api/profiles/me. Renamed users.rs
  get_profile/update_profile (the /api/users/me handlers) to
  get_account/update_account to resolve a name collision.
- Register accepts default_profile_* fields and auto-creates the self
  profile when the client provides a wrapped profile DEK.
- HealthStatistic + Appointment gain profile_id and ?profile_id=
  filtering (health stats previously had no profile binding).
- New profile_tests.rs: multi-profile CRUD + ownership isolation +
  register-with-default-profile. Fixed the zk health-stat test to
  send the now-required profile_id.

Frontend:
- crypto/keys.ts: generateProfileDek, wrapProfileDek, unwrapProfileDek
  + in-memory per-profile DEK store with an active-profile concept.
- useProfileStore rewritten: holds profiles[], activeProfileId;
  loadProfiles unwraps each profile DEK; create/update/delete. All 11
  encrypt/decrypt sites switched from getEncKey() to
  getActiveProfileDek(). load actions pass ?profile_id= so only the
  active profile's rows come back.
- ProfileEditor rewritten for the new store (edit active profile,
  create/delete). New ProfileSwitcher in the Dashboard AppBar.
- MedicationManager / AppointmentsManager use the active profile id
  instead of the hardcoded profile_<user_id>.
- 2 new crypto tests for per-profile DEK isolation; updated store +
  component tests for the active-profile-DEK model.

Verification: backend cargo build/clippy/fmt green, tests compile
(integration tests run in CI — Mongo is fixed there). Frontend
tsc clean, 30/30 tests pass.

Closes nothing yet (Phase B/C/D remain). Refs #3.

web/normogen-web/src/services/api.ts

@@ -18,6 +18,8 @@ import {
   MedicationWireResponse,
   AppointmentWireResponse,
   ProfileWireResponse,
+  CreateProfileRequest,
+  UpdateProfileRequest,
   HealthStatWireResponse,
   UpdateHealthStatRequest,
   EncryptedFieldWire,
@@ -232,25 +234,37 @@ class ApiService {
     });
   }
 
-  // ---- Profile (zero-knowledge: opaque encrypted name) ----
+  // ---- Profiles (Phase A2: multi-profile, per-profile DEKs) ----
 
-  async getProfile(): Promise<ProfileWireResponse> {
-    const response = await this.client.get<ProfileWireResponse>('/profiles/me');
+  async listProfiles(): Promise<ProfileWireResponse[]> {
+    const response = await this.client.get<ProfileWireResponse[]>('/profiles');
     return response.data;
   }
 
-  async updateProfileName(nameData: string, nameIv: string): Promise<ProfileWireResponse> {
-    const response = await this.client.put<ProfileWireResponse>('/profiles/me', {
-      name_data: nameData,
-      name_iv: nameIv,
-    });
+  async createProfile(req: CreateProfileRequest): Promise<ProfileWireResponse> {
+    const response = await this.client.post<ProfileWireResponse>('/profiles', req);
     return response.data;
   }
 
+  async getProfile(profileId: string): Promise<ProfileWireResponse> {
+    const response = await this.client.get<ProfileWireResponse>(`/profiles/${profileId}`);
+    return response.data;
+  }
+
+  async updateProfile(profileId: string, req: UpdateProfileRequest): Promise<ProfileWireResponse> {
+    const response = await this.client.put<ProfileWireResponse>(`/profiles/${profileId}`, req);
+    return response.data;
+  }
+
+  async deleteProfile(profileId: string): Promise<void> {
+    await this.client.delete(`/profiles/${profileId}`);
+  }
+
   // ---- Medications (zero-knowledge: opaque encrypted blobs) ----
 
-  async getMedications(): Promise<MedicationWireResponse[]> {
-    const response = await this.client.get<MedicationWireResponse[]>('/medications');
+  async getMedications(profileId?: string): Promise<MedicationWireResponse[]> {
+    const params = profileId ? { profile_id: profileId } : undefined;
+    const response = await this.client.get<MedicationWireResponse[]>('/medications', { params });
     return response.data;
   }
 
@@ -287,9 +301,12 @@ class ApiService {
 
   // ---- Appointments (zero-knowledge: opaque encrypted blobs) ----
 
-  async getAppointments(status?: string): Promise<AppointmentWireResponse[]> {
+  async getAppointments(status?: string, profileId?: string): Promise<AppointmentWireResponse[]> {
+    const params: Record<string, string> = {};
+    if (status) params.status = status;
+    if (profileId) params.profile_id = profileId;
     const response = await this.client.get<AppointmentWireResponse[]>('/appointments', {
-      params: status ? { status } : undefined,
+      params: Object.keys(params).length ? params : undefined,
     });
     return response.data;
   }
@@ -332,8 +349,9 @@ class ApiService {
 
   // ---- Health Statistics (zero-knowledge: opaque encrypted blobs) ----
 
-  async getHealthStats(): Promise<HealthStatWireResponse[]> {
-    const response = await this.client.get<HealthStatWireResponse[]>('/health-stats');
+  async getHealthStats(profileId?: string): Promise<HealthStatWireResponse[]> {
+    const params = profileId ? { profile_id: profileId } : undefined;
+    const response = await this.client.get<HealthStatWireResponse[]>('/health-stats', { params });
     return response.data;
   }