feat(18-03): add profile routes, public setup endpoint, and auth middleware updates

- GET /api/users/:id/profile: public profile with public setups (no auth)
- PUT /api/auth/profile: update own profile (requires auth)
- GET /api/setups/:id/public: public setup view with items (no auth)
- Auth middleware skips public profile and public setup GET endpoints
- Register profileRoutes at /api/users in index.ts
- Add getOrCreateUncategorized to category service (Rule 3 fix)
- 10 route tests covering auth, public access, and 404 cases

src/server/routes/auth.ts

@@ -9,6 +9,8 @@ import {
 	deleteApiKey,
 	listApiKeys,
 } from "../services/auth.service.ts";
+import { updateProfile } from "../services/profile.service.ts";
+import { updateProfileSchema } from "../../shared/schemas.ts";
 
 type Env = { Variables: { db?: any; userId?: number } };
 
@@ -69,4 +71,20 @@ app.delete("/keys/:id", requireAuth, async (c) => {
 	return c.json({ ok: true });
 });
 
+// ── Profile Update (protected) ──────────────────────────────────────
+
+app.put(
+	"/profile",
+	requireAuth,
+	zValidator("json", updateProfileSchema),
+	async (c) => {
+		const db = c.get("db");
+		const userId = c.get("userId")!;
+		const data = c.req.valid("json");
+		const updated = await updateProfile(db, userId, data);
+		if (!updated) return c.json({ error: "User not found" }, 404);
+		return c.json(updated);
+	},
+);
+
 export const authRoutes = app;