resolveProfile created an empty profile for any caller with create-intent,
including an admin merely viewing someone else's profile. Restrict
lazy-create to the user's own profile; an admin reading another user's
missing profile now gets 404 with no side-effect record. Doc updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
GET/PATCH /api/v1/user-profile/{uuid} now accept either a profile uuid or
the owning user's uuid, and lazily create an empty profile for a user who
has none — documented with the double-nested response note.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
hamed