feat(profile): self-service name/email/password + desktop installers in CI

Self-service profile: any signed-in user edits their OWN fullName/email and
changes their OWN password (proving the current one), without any user:*
permission. New routes PUT /api/auth/profile + /api/auth/password act only on
req.user.sub (cannot touch username/role), CSRF-guarded; SPA screen at /profile
reachable from the header username chip. email added to the session view +
SessionUser. 7 tests (routes/profile.test.ts); 148 server tests green.

Desktop in CI: new .gitea/workflows/build-desktop.yml builds .deb + .AppImage
on every push to dev/main and uploads them as unsigned workflow artifacts
(per-commit test build). Signed/versioned release stays on release.yml (tag v*).

Wiki: local-jwt-auth (self-service routes), desktop-shell-tauri (two-workflow CI
split), log entry.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/router.tsx

@@ -31,6 +31,7 @@ import { RolesManager } from "./RolesManager.js";
 import { ShiftsHistory } from "./ShiftsHistory.js";
 import { LogsViewer } from "./LogsViewer.js";
 import { RecycleBin } from "./RecycleBin.js";
+import { Profile } from "./Profile.js";
 // Reports pulls in Recharts (~heavy) — lazy-loaded so it stays OUT of the booth's
 // initial bundle and only downloads when an admin opens /setup/reports.
 const Reports = lazy(() => import("./Reports.js").then((m) => ({ default: m.Reports })));
@@ -399,9 +400,15 @@ function RootLayout() {
           {user && <LanguageToggle user={user} setUser={setUser} />}
           {user && <ThemeToggle user={user} setUser={setUser} />}
           <StatusDot />
-          <span className="text-[11px] text-term-muted">
-            {user?.username} · {user?.roleName}
-          </span>
+          {user && (
+            <Link
+              to="/profile"
+              title={t("nav.profile")}
+              className="text-[11px] text-term-muted hover:text-term-text [&.active]:text-term-amber"
+            >
+              {user.username} · {user.roleName}
+            </Link>
+          )}
           <button
             type="button"
             className="btn btn-ghost btn-sm"
@@ -635,10 +642,23 @@ const logsRoute = createRoute({
   component: LogsViewer,
 });
 
+// My profile — self-service for ANY signed-in user (no permission gate). Edits only
+// the caller's own name/email/password. See Profile.tsx and routes/auth.ts.
+const profileRoute = createRoute({
+  getParentRoute: () => rootRoute,
+  path: "profile",
+  component: function ProfileRoute() {
+    const { user, setUser } = rootRoute.useRouteContext();
+    if (!user) return null;
+    return <Profile user={user} setUser={setUser} />;
+  },
+});
+
 const routeTree = rootRoute.addChildren([
   indexRoute,
   boothRoute,
   ...legacyRedirects,
+  profileRoute,
   shiftRoute,
   reportsRoute,
   subscriptionsRoute.addChildren([