feat: complete auth/profile username migration and runtime safeguards

backend/tests/e2e/test_auth_flow.py

@@ -95,7 +95,11 @@ def test_auth_flow_e2e() -> None:
                 signup = request_context.post(
                     "/api/v1/auth/signup",
                     data=json.dumps(
-                        {"email": "user@example.com", "password": "secret123"}
+                        {
+                            "username": "demo",
+                            "email": "user@example.com",
+                            "password": "secret123",
+                        }
                     ),
                     headers={"Content-Type": "application/json"},
                 )

backend/tests/e2e/test_profile_flow.py

@@ -27,11 +27,10 @@ class FakeProfileService:
     async def update_me(self, update: ProfileUpdateRequest) -> ProfileResponse:
         return ProfileResponse(
             id=self._profile.id,
-            username=self._profile.username,
-            display_name=(
-                update.display_name
-                if update.display_name is not None
-                else self._profile.display_name
+            username=(
+                update.username
+                if update.username is not None
+                else self._profile.username
             ),
             avatar_url=(
                 update.avatar_url
@@ -75,7 +74,6 @@ def test_profile_flow_e2e() -> None:
     profile = ProfileResponse(
         id=str(user_id),
         username="demo",
-        display_name="Demo User",
         avatar_url=None,
         bio=None,
     )
@@ -98,11 +96,11 @@ def test_profile_flow_e2e() -> None:
 
                 updated = request_context.patch(
                     "/api/v1/profile/me",
-                    data=json.dumps({"display_name": "Updated"}),
+                    data=json.dumps({"username": "updated"}),
                     headers={"Content-Type": "application/json"},
                 )
                 assert updated.status == 200
-                assert updated.json()["display_name"] == "Updated"
+                assert updated.json()["username"] == "updated"
 
                 public = request_context.get("/api/v1/profile/demo")
                 assert public.status == 200