fix(user-profile): don't lazy-create when an admin views another user

resolveProfile created an empty profile for any caller with create-intent,
including an admin merely viewing someone else's profile. Restrict
lazy-create to the user's own profile; an admin reading another user's
missing profile now gets 404 with no side-effect record. Doc updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/UserProfile/Controller/UserProfileController.php

@@ -95,8 +95,9 @@ class UserProfileController extends BaseController
     /**
      * Resolve a profile from a uuid that may be the profile's own uuid or the
      * owning user's uuid. When $createIfMissing is true and the uuid belongs to
-     * a user (the current user or, for admins, anyone) without a profile, an
-     * empty profile is created and persisted.
+     * the **current user** without a profile, an empty profile is created and
+     * persisted. An admin viewing another user's missing profile gets null (no
+     * record is created as a side effect of reading).
      */
     private function resolveProfile(string $uuid, User $currentUser, bool $createIfMissing): ?UserProfile
     {
@@ -115,11 +116,9 @@ class UserProfileController extends BaseController
             return $profile;
         }
 
-        if (!$createIfMissing) {
-            return null;
-        }
-
-        if ($targetUser->getId() !== $currentUser->getId() && !$currentUser->hasRole('ROLE_ADMIN')) {
+        // Only lazy-create for the user's own profile, never as a side effect of
+        // an admin reading someone else's.
+        if (!$createIfMissing || $targetUser->getId() !== $currentUser->getId()) {
             return null;
         }