feat(gateway): durable user profiles with email aliases and avatars (#111224)

* feat(gateway): durable user profiles with email aliases and avatars

* fix(gateway): compress merge tombstones, content-hash avatar ETags, users CLI json output

* fix(gateway): lean profile listing, scoped avatar routing, typed email validation

* fix(gateway): protocol-complete profile payloads and consistent store reads

* fix(gateway): mark profile schema ensured only after commit

* fix(gateway): avatar endpoint HEAD support and RFC If-None-Match

* fix(gateway): profiles CI conformance — bindings, lint, knip, sql boundary

* feat(gateway): self-service profile edits for authenticated users

* fix(gateway): users.self bootstrap, tombstone-aware ownership, escaped CLI output

* fix(gateway): raw-DDL allowlist entry and lean profile exports

src/cli/program/register.subclis-core.ts

@@ -154,6 +154,11 @@ const entrySpecs: readonly CommandGroupDescriptorSpec<SubCliRegistrar>[] = [
       loadModule: () => import("../devices-cli.js"),
       exportName: "registerDevicesCli",
     },
+    {
+      commandNames: ["users"],
+      loadModule: () => import("../users-cli.js"),
+      exportName: "registerUsersCli",
+    },
     {
       commandNames: ["node"],
       loadModule: () => import("../node-cli.js"),

src/cli/program/subcli-descriptors.ts

@@ -71,6 +71,12 @@ const subCliCommandCatalog = defineCommandDescriptorCatalog([
     hasSubcommands: true,
     parentDefaultHelp: true,
   },
+  {
+    name: "users",
+    description: "Manage durable user profiles and email aliases",
+    hasSubcommands: true,
+    parentDefaultHelp: true,
+  },
   {
     name: "node",
     description: "Run and manage the headless node host service",