test(cabana): cover My account profile, password and avatar

- account_internal_test: metadata subtitle reader and writer (NULL, blank,
  null, [], invalid JSON, non-objects, key preservation, NULL on the last
  key), the attachOne contract, avatar cap, unique-violation mapping,
  English fallbacks, and 401 for non-backend principals on all three routes
- account_test (Postgres): profile payload incl. copied WinterCMS metadata
  and avatar rows, trimmed profile saves and metadata keys, the forbidden-key
  allow-list with unchanged rows, email rules, password rules, the failed
  attempt log, Bearer and cookie session effects, CSRF, avatar upload,
  refusals (SVG, HTML as PNG, size, part shape, 413, no bucket) with no row
  or blob left, replace and remove with blob cleanup
- lagoon: TestBackendAdminMetadataColumn covers type, Winter row round trip,
  rollback of only the column and re-migrate
- SPA: AccountView, the user menu account item and avatar image,
  setCurrentUser and profileInitials; lang fixture gains myaccount keys

admin/tests/state/useAuth.test.ts

@@ -1,5 +1,14 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { clearUser, currentUser, login, logout, me, useAuth } from '../../src/state/useAuth'
+import {
+  clearUser,
+  currentUser,
+  login,
+  logout,
+  me,
+  profileInitials,
+  setCurrentUser,
+  useAuth,
+} from '../../src/state/useAuth'
 import { navigation, setNavigation } from '../../src/state/useNavigation'
 import { setSettings, settings } from '../../src/state/useSettings'
 import { navigationFixture, settingsFixture } from '../fixtures/typed'
@@ -139,3 +148,24 @@ describe('logout (T-10-23)', () => {
     expect(auth.clearUser).toBe(clearUser)
   })
 })
+
+describe('setCurrentUser and profileInitials', () => {
+  it('replaces the signed-in profile, as My account does after a save', async () => {
+    mockApi({ [`GET ${API}/auth/me`]: { body: profile } })
+    await me()
+    const next = { ...profile.data, first_name: 'Grace', subtitle: 'Admiral', avatar: { url: '/a.png' } }
+    setCurrentUser(next)
+    expect(currentUser.value).toEqual(next)
+    expect(useAuth().user.value?.subtitle).toBe('Admiral')
+    expect(useAuth().setCurrentUser).toBe(setCurrentUser)
+    clearUser()
+    expect(currentUser.value).toBeNull()
+  })
+
+  it('takes the name initials, else the login letters', () => {
+    expect(profileInitials(null)).toBe('')
+    expect(profileInitials({ first_name: 'grace', last_name: 'hopper', login: 'gh' })).toBe('GH')
+    expect(profileInitials({ first_name: ' ', last_name: 'Hopper', login: 'gh' })).toBe('H')
+    expect(profileInitials({ first_name: '', last_name: '', login: 'root' })).toBe('RO')
+  })
+})