feat(profile): self-service name/email/password + desktop installers in CI

Self-service profile: any signed-in user edits their OWN fullName/email and
changes their OWN password (proving the current one), without any user:*
permission. New routes PUT /api/auth/profile + /api/auth/password act only on
req.user.sub (cannot touch username/role), CSRF-guarded; SPA screen at /profile
reachable from the header username chip. email added to the session view +
SessionUser. 7 tests (routes/profile.test.ts); 148 server tests green.

Desktop in CI: new .gitea/workflows/build-desktop.yml builds .deb + .AppImage
on every push to dev/main and uploads them as unsigned workflow artifacts
(per-commit test build). Signed/versioned release stays on release.yml (tag v*).

Wiki: local-jwt-auth (self-service routes), desktop-shell-tauri (two-workflow CI
split), log entry.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/decisions/desktop-shell-tauri.md

@@ -167,3 +167,19 @@ Per the user's choices — the operator **keeps OS access** (no fullscreen lockd
   Windows/macOS "unknown publisher", and from the [[atecc608]]/[[tpm]] **event** signing.)*
 - **Still deferred:** the actual update-hosting URL, OS-level installer signing
   (Windows/macOS publisher trust), and the Windows kiosk-browser fallback path.
+
+### Desktop in CI — two workflows, two purposes (added 2026-06-24)
+
+The desktop bundle now runs in CI under **two distinct workflows** — keep the split clear:
+
+- **`.gitea/workflows/release.yml`** (tag `v*`) — the **signed, versioned release**: builds
+  `.deb`/`.rpm`/`.AppImage` **+ their `.sig`** (updater key from secrets), assembles `latest.json`,
+  and publishes a Gitea Release. This is what the auto-updater consumes. Unchanged.
+- **`.gitea/workflows/build-desktop.yml`** (push to `dev`/`main`) — a **per-commit test build**:
+  compiles `.deb` + `.AppImage` only (`pnpm --filter @parking/desktop bundle --bundles deb,appimage`)
+  and uploads them as **workflow artifacts** (14-day retention). **Unsigned** — no `TAURI_SIGNING_*`,
+  no Release, no `latest.json` — so it must NEVER be wired to the updater (an unsigned artifact would
+  be rejected anyway). It exists so each branch push yields a downloadable installer for manual
+  testing of the native shell, and catches a broken Tauri/Rust build early. Same system-deps + cargo
+  cache as `release.yml`. The container images (`build-images.yml`) and the desktop installers are
+  deliberately separate pipelines — the desktop app is **not** containerized ([[container-deployment]]).