API:
- PATCH /auth/me — update email and display name
- PATCH /auth/me/password — change password (requires current)
- GET /auth/me now returns full profile (email, full_name, role)
CLI:
- python -m src.cli.reset_password --email <email> --password <pw>
for recovery when locked out (run via docker exec)
Admin UI:
- User menu dropdown on the top nav (click username → Account /
Sign out) replaces the inline sign-out link
- /account page with profile form (email + display name) and
change password form (current + new + confirm)
d8e0a34e04