refactor: align backend layout and supabase infra

Consolidate backend modules/tests under the backend package while syncing Supabase compose/env config and related plans.

backend/tests/unit/v1/profile/test_schemas.py

@@ -0,0 +1,61 @@
+from __future__ import annotations
+
+import pytest
+from pydantic import ValidationError
+
+from v1.profile.schemas import ProfileResponse, ProfileUpdateRequest
+
+
+def test_profile_response_maps_fields() -> None:
+    response = ProfileResponse(
+        id="user-1",
+        username="demo",
+        display_name="Demo User",
+        avatar_url=None,
+        bio=None,
+    )
+
+    assert response.id == "user-1"
+    assert response.username == "demo"
+
+
+def test_profile_update_requires_one_field() -> None:
+    with pytest.raises(ValidationError):
+        ProfileUpdateRequest()
+
+
+def test_profile_update_accepts_valid_https_url() -> None:
+    request = ProfileUpdateRequest(avatar_url="https://example.com/avatar.png")
+    assert request.avatar_url == "https://example.com/avatar.png"
+
+
+def test_profile_update_accepts_valid_http_url() -> None:
+    request = ProfileUpdateRequest(
+        avatar_url="http://localhost:8001/storage/avatar.png"
+    )
+    assert request.avatar_url == "http://localhost:8001/storage/avatar.png"
+
+
+def test_profile_update_rejects_invalid_url() -> None:
+    with pytest.raises(ValidationError) as exc_info:
+        ProfileUpdateRequest(avatar_url="not-a-valid-url")
+
+    errors = exc_info.value.errors()
+    assert len(errors) == 1
+    assert "avatar_url" in str(errors[0]["loc"])
+
+
+def test_profile_update_rejects_javascript_url() -> None:
+    with pytest.raises(ValidationError):
+        ProfileUpdateRequest(avatar_url="javascript:alert('xss')")
+
+
+def test_profile_update_rejects_data_url() -> None:
+    with pytest.raises(ValidationError):
+        ProfileUpdateRequest(avatar_url="data:text/html,<script>alert('xss')</script>")
+
+
+def test_profile_update_accepts_none_avatar_url_with_other_field() -> None:
+    request = ProfileUpdateRequest(display_name="Test", avatar_url=None)
+    assert request.avatar_url is None
+    assert request.display_name == "Test"