feat: configurable Nostr profile (kind 0) from the dashboard

[sovITxyz]

Closes #11.

What

Adds a /dashboard/profile page where a signed-in user edits and publishes their Nostr kind 0 profile metadata — name, display name, about, picture, banner, website, NIP-05, and the lud16 lightning address (the NIP-57 zaps prerequisite, #12).

• src/views/main/profile.tsx + public/js/profile.js — form prefilled from the stored profile; the kind 0 is built and signed entirely client-side through the existing NbreadSigner (NIP-07/46/55/nsec), mirrored to /api/mirror, and broadcast to editorRelays() with NIP-42 AUTH — the exact editor.js publish contract, including the NIP-55/Amber redirect-resume + no-resign retry flow. Blossom uploads are wired to the picture/banner fields.
• /api/mirror accepts kind 0 (option (a) from the issue): same session gate, ev.pubkey === sess.pubkey tenant isolation, rate limit, and blocked check; mirrorEvent already routed kind 0 to upsertProfile. The MAX_POSTS_PER_PUBKEY cap stays 30023-only — kind 0 is a single replaceable slot and cannot grow storage.
• Migration 0006: profiles.lud16 + parsing in upsertProfile (open question 4 → column, since zaps must read it on the render path).
• Replaceable semantics: the page passes the stored created_at as prevCreatedAt; the client publishes with max(now, prev+1) so an edit always wins the (pubkey, 0, '') slot.
• Round-trip fidelity: unknown kind-0 content keys are preserved through config.extra and merged back on publish, so a save never erases custom metadata written by other clients. Prefill is faithful (no trim/caps — truncation would rewrite the canonical profile network-wide); caps still bound the D1 columns and form typing.
• NIP-24 deprecated aliases (displayName/username) prefill their canonical field when it's absent and are dropped from the republish, per NIP-24.
• nip05 suggestion: <handle>@nbread.lol pre-fills only a first profile (never resurrects a deliberately removed nip05); shown as a hint otherwise. The settings-About-overrides-profile-bio relationship is surfaced next to the About field.

Security

• Apex-only (APEX_CSP already allows self scripts, wss:, Blossom hosts); blog pages stay JS-free.
• No server-side key handling — the server only ever sees the signed event.
• All prefill values are hostile-by-assumption relay data: attribute/text escaping via hono/jsx, config JSON <-escaped in a non-executable script tag, __proto__ content keys kept as data via null-prototype objects on both sides.
• An adversarial multi-agent review (5 dimensions × 3-skeptic verification) ran over the diff; all four confirmed findings are fixed in the second commit.

Tests

873 passing (14 new): page auth/prefill/XSS, kind-0 mirror accept + cross-key 403 + newest-wins + lud16 caps, storedProfileContent fidelity/alias/__proto__ cases, and the editor kind-guard update.