docs: update roadmap, config, and UAT state

.planning/phases/28-profile-and-logto-integration/28-UAT.md

@@ -1,9 +1,9 @@
 ---
-status: partial
+status: complete
 phase: 28-profile-and-logto-integration
 source: [28-01-SUMMARY.md, 28-02-SUMMARY.md, 28-03-SUMMARY.md]
 started: 2026-04-12T18:30:00Z
-updated: 2026-04-12T19:00:00Z
+updated: 2026-04-12T21:00:00Z
 ---
 
 ## Current Test
@@ -24,29 +24,23 @@ result: pass
 expected: /settings page shows only app preferences: weight unit, currency, import/export, API keys. No profile section.
 result: pass
 
-### 4. Edit display name and bio
-expected: On /profile, change display name and bio, click Save. Success message appears. Refreshing the page shows the updated values.
-result: issue
-reported: "Save works for name/bio after Zod null fix, but avatar upload doesn't persist after save. Also needs: crop editor for avatar, larger profile pic with name/bio side-by-side layout, click-to-open modal with full-size image + Remove/Update buttons."
-severity: major
+### 4. Edit display name, bio, and avatar
+expected: On /profile, upload an avatar, change display name and bio, click Save. Avatar image renders. Refreshing shows updated values.
+result: pass
+reported: "Fixed: avatar now uses presigned S3 URLs instead of /uploads/ paths. Avatar also shows in top nav."
 
 ### 5. Email display
 expected: Account Info section shows your email address (from Logto) and a "Change" button next to it.
-result: blocked
-blocked_by: third-party
-reason: "Logto Management API returns 500 — M2M env vars (LOGTO_MANAGEMENT_API_ENDPOINT, LOGTO_M2M_APP_ID, LOGTO_M2M_APP_SECRET) not configured on test env"
+result: pass
+reported: "Fixed: M2M credentials configured, email change now reflects in UI immediately via optimistic cache update."
 
 ### 6. Password change form
-expected: Security section shows a password change form. If you signed in with email+password: current password, new password, confirm new password fields. If social login only: just new password + confirm fields.
-result: blocked
-blocked_by: third-party
-reason: "Logto Management API returns 500 — M2M env vars not configured on test env"
+expected: Security section shows a password change form. Current password, new password, confirm new password fields.
+result: pass
 
 ### 7. Delete account UI
 expected: Danger Zone shows a red-bordered card with "Delete Account" button. Clicking it shows a confirmation dialog requiring you to type "DELETE" before proceeding.
-result: blocked
-blocked_by: third-party
-reason: "Logto Management API returns 500 — M2M env vars not configured on test env"
+result: pass
 
 ### 8. Member-since date
 expected: Account Info section shows a "Member since" date formatted nicely (e.g., "April 2026").
@@ -55,22 +49,12 @@ result: pass
 ## Summary
 
 total: 8
-passed: 4
-issues: 1
+passed: 8
+issues: 0
 pending: 0
 skipped: 0
-blocked: 3
+blocked: 0
 
 ## Gaps
 
-- truth: "Avatar upload should persist after save. Profile pic should have crop editor, larger display with side-by-side layout, and click-to-open modal."
-  status: failed
-  reason: "User reported: avatar upload doesn't persist. Also needs crop editor, layout redesign (larger pic, name/bio beside it), click-to-open modal with Remove/Update."
-  severity: major
-  test: 4
-  artifacts:
-    - src/client/components/ProfileSection.tsx
-  missing:
-    - Avatar save persistence fix
-    - Crop editor integration for avatar
-    - Profile layout redesign (larger pic, side-by-side, modal)
+[none]