Add ability for users to update their display name with optional machine/human review.

Backend:

• Add profile_change_request table (V15 migration)
• Add UserProfileService with moderation workflow
• Add PATCH /api/v1/user/profile and GET /api/v1/user/profile endpoints
• Add ProfileModerationService interface with NoOp implementation
• Add ProfileModerationProperties for machine/human review toggles
• Update AuthController /me to refresh session when displayName changes
• Add i18n messages for profile validation and responses

Frontend:

• Add /settings/profile page with edit-on-click pattern
• Add profileApi.updateProfile() to client
• Update user menu: add "Profile Settings", make "Security Settings" local-only
• Add i18n translations (en/zh) for profile settings

Testing:

• Add UserProfileControllerTest with 8 test cases
• Add UserProfileServiceTest with 6 test cases
• Add AuthControllerTest case for session refresh on displayName change

Summary

• What changed?
• Why is this needed?

Validation

• Backend tests passed
• Frontend typecheck/build passed
• OpenAPI SDK regenerated or checked when API contracts changed
• Smoke test run when relevant

Commands run:

# paste commands here

Risk

• User-facing impact:
• Deployment or migration impact:
• Rollback approach:

Notes

• Related issue:
• Follow-up work:
• Docs or operator runbooks updated when behavior changed: