feat(user): full /user/profile REST surface

Replaces the upstream POST /user/profile stub + auth.admin.deleteUser
account-deletion path with:

  * GET    /user/profile               - returns the profile row plus
                                          a global_api_keys map telling
                                          the frontend which providers
                                          have shared keys configured
                                          server-side.
  * PATCH  /user/profile                - whitelist of editable fields
                                          (display_name, organisation,
                                          tabular_model, fast_model,
                                          claude/gemini/openai/aoai keys).
  * POST   /user/profile/credits/increment - used by chat to count
                                          billable messages.
  * DELETE /user/account                - cascades through every
                                          user-owned table; returns 403
                                          in entra mode (account closure
                                          for tenant-owned identities is
                                          handled out of band by the
                                          tenant admin).

GET /user/profile also normalises credits_reset_date so the 30-day
window self-refreshes when the previous one has passed. The auth-
admin-deleteUser path is gone - provider-specific identity teardown is
the IdP's responsibility, not the app's.