feat: add configurable user profile fields plugin

[lane711]

Summary

• Adds a user-profiles core plugin that lets developers define custom profile fields via defineUserProfile() at app boot
• Custom field data stored as JSON in a new data column on user_profiles — no new tables or per-field schema migrations
• Admin UI renders custom fields automatically using the existing renderDynamicField system
• Custom fields appear on both the admin user edit page and the self-service profile page
• API endpoints for reading/writing custom data and fetching the schema
• Registration integration: custom fields can be captured during signup via registrationFields config

Changes

New Files

File	Purpose
plugins/core-plugins/user-profiles/index.ts	Plugin entry point (PluginBuilder + API routes)
plugins/core-plugins/user-profiles/user-profile-registry.ts	defineUserProfile() singleton config registry
plugins/core-plugins/user-profiles/user-profile-service.ts	Validation, sanitization, DB read/write
plugins/core-plugins/user-profiles/user-profile-renderer.ts	Adapts field definitions → renderDynamicField
plugins/core-plugins/user-profiles/manifest.json	Plugin metadata
db/migrations/0011_user_profiles_data.sql	ALTER TABLE user_profiles ADD COLUMN data
__tests__/plugins/user-profile-registry.test.ts	Registry unit tests
__tests__/plugins/user-profile-service.test.ts	Service unit tests

Modified Files

File	Changes
db/migrations-bundle.ts	Add migration 034
app.ts	Register plugin routes
index.ts	Export defineUserProfile, types
plugins/core-plugins/index.ts	Export plugin, add to CORE_PLUGIN_IDS
services/plugin-bootstrap.ts	Add to CORE_PLUGINS array
routes/admin-users.ts	Read/write custom data on user edit + self-profile
templates/pages/admin-user-edit.template.ts	Accept injected custom fields HTML
templates/pages/admin-profile.template.ts	Accept injected custom fields HTML
routes/auth.ts	Save custom fields during registration

Developer Usage

import { defineUserProfile } from "@sonicjs-cms/core"

defineUserProfile({
  fields: [
    { name: "plan", label: "Subscription Plan", type: "select",
      options: ["free", "pro", "enterprise"], default: "free" },
    { name: "company_size", label: "Company Size", type: "number" },
  ],
  registrationFields: ["plan"],
})

Testing

• 24 new unit tests pass (registry + service)
• Full test suite passes (1436 tests, 0 failures)
• TypeScript compiles with no errors
• E2E tests (CI)

Checklist

• Follows existing plugin architecture (OAuth providers pattern)
• No new TypeScript errors
• Zero breaking changes — no custom fields rendered when defineUserProfile() not called
• All string values sanitized via sanitizeInput() before storage
• Merge semantics on update (partial saves don't wipe existing custom data)

Closes #744

🤖 Generated with Claude Code