feat(profile): profile settings modal (name + avatar) and move dev ports to 400x

[raaymax]

Summary

Adds a Profile Settings modal so users can change their display name and upload an avatar, re-adding avatar support that was dropped during the files-root-entity work — decoupled from channel File entities so profile assets never pollute the channel Files view. Also moves the local dev ports into the 400x range to avoid a collision on port 3000.

Changes

Profile settings (feature)

Backend

• user:setProfile and user:setAvatar commands, each broadcasting {type:"user"} over the existing SSE pipeline.
• PATCH /api/profile (name) and PUT /api/profile/avatar (raw image stream → core.storage.upload), mounted on the existing profile router.
• Both responses go through serializeUser, so secrets/password hash never leak; setAvatar best-effort removes the previous blob.
• Avatar/name upload via storage directly — no channel File entity created.

Frontend

• New ProfileSettings organism (opened from the sidebar user entry) + Storybook story.
• AppModel.updateProfile / uploadAvatar actions and API client methods.
• UserModel.patch now also applies avatarFileId/alias/status, so avatar changes render live via SSE (previously it only patched name).
• Modal lifted into the Sidebar organism to respect the atomic-design import hierarchy (molecules must not import organisms).
• Email is shown read-only — it is the PBKDF2 salt for both the auth hash and the encryption key, so changing it is a separate crypto-migration, not a profile field.

Dev ports (chore)

• Frontend 3000→4000, backend 3001→4001, Storybook 6006→4006.
• Updates the Vite /api proxy target, backend PORT/baseUrl defaults, mobile-config dev-URL rewrite, capacitor config, and docs. The PORT env override (e.g. Docker's 8080) is unchanged.

Docs

• ARCHITECTURE.md: add the new user/ commands and the profile/ route module.
• Port references updated in CLAUDE.md and docs/mobile-app.md.

Testing

• Added deno route tests for the profile endpoints (auth, name update, empty-name rejection, avatar set, non-image rejection, blob replacement, plus assertions that responses don't leak secrets) — 9/9 pass.
• Emoji + command suites still green (20/20) after the command-collection change.
• deno check / deno lint / deno fmt clean; frontend pnpm types shows no new errors; ESLint clean on changed files; build-storybook compiles with the new story.