PM-44: profile page, signed-in chrome, PM-50 login fix + infra
Profile: /profile/:actor + /profile self route; two-column identity rail + tabs + reused ThingCard grid; Bluesky fallback for actors with no polymodel profile; pre-wrap + linkified bio; clickable maker handles (profile_href) on cards + detail.
Signed-in chrome: avatar-only account dropdown in the top nav; AuthenticatedIdentity retains the avatar from getSession; getSession enriches the session profile from the Bluesky profile when there is no polymodel profile record.
PM-50: getSession resolves the handle via projection + DID-document fallback (resolve_handle) instead of projection-only handle_for_did, so authenticated users are no longer reported signed-out.
Infra: OAuth keyset provisioning now uses a durable keyring keyset or falls back to public OAuth (no ephemeral keys that poison the PDS cache); tracing initialized before dioxus::serve with an info,hydrant=warn default and wasm capped at INFO; appview per-request timing middleware.
Validation: just test-all green (53 default/wasm + 90 server). Follow-ups: PM-53 (renderer -> Web Worker + separate bundle), PM-54 (SSR first paint).