feat(cabana): add the My account page with subtitle and password change

- lagoon: 202610090001_backend_users_metadata adds WinterCMS's nullable
  jsonable backend_users.metadata column (TEXT); rollback drops only it
- cabana.BackendUser.Metadata and Subtitle read metadata.subtitle leniently
  (NULL, blank, null, [], invalid JSON and non-strings read as empty)
- GET /auth/me returns subtitle; PUT /account edits the signed-in admin's
  own names, email and subtitle, and the password with current_password;
  any other key is a 422 and nothing is written
- email: required, valid, 6-255 chars, unique against other admins' email
  and login ignoring case (soft-deleted included); a unique-index race is 422
- a password change sets tokens_valid_after, revokes the presented token and
  gives a cookie session a fresh cookie
- swag annotation, regenerated admin.json and schema.d.ts; route inventories,
  CSRF walk (27) and OpenAPI conformance learn the route
- SPA: My account item in the user menu opens /account (AccountView), which
  saves through PUT /account and updates the top bar via setCurrentUser
- backend::lang.myaccount strings (en, pl), rebuilt boardwalk dist
- cabana and lagoon READMEs, users-and-permissions and admin-spa docs

admin/src/state/useAuth.ts

@@ -54,6 +54,11 @@ export async function me(): Promise<AdminProfile | null> {
   return user.value
 }
 
+/** Replaces the signed-in profile, e.g. with the one PUT /account returned. */
+export function setCurrentUser(profile: AdminProfile): void {
+  user.value = profile
+}
+
 export function clearUser(): void {
   cancelRefresh()
   user.value = null
@@ -88,6 +93,7 @@ export function useAuth() {
     login,
     logout,
     me,
+    setCurrentUser,
     clearUser,
   }
 }