Unify host profile view as framed dialog, add profile iframe mode

HostProfileView now renders the same centered frame card as the login
flows, whether shown full-page at /auth/ (host mode) or inside the new
#mode=profile restricted iframe. The component self-fetches its data
when the parent does not provide it, and emits back/logout so each
context reacts appropriately: the full page reloads, the iframe posts
auth-back / auth-logout to the host.

frontend/auth/restricted/RestrictedApi.vue

@@ -1,5 +1,11 @@
 <template>
+  <HostProfileView
+    v-if="authMode === 'profile'"
+    @back="handleBack"
+    @logout="handleLogout"
+  />
   <RestrictedAuth
+    v-else
     :mode="authMode"
     :remote-auth-token="remoteAuthToken"
     :oidc-query-string="oidcQueryString"
@@ -11,6 +17,7 @@
 <script setup>
 import { onMounted, ref } from 'vue'
 import RestrictedAuth from '@/components/RestrictedAuth.vue'
+import HostProfileView from '@/components/HostProfileView.vue'
 
 // Check if this is a remote auth URL: /auth/{token}
 // The token is a 5-word passphrase like "word1.word2.word3.word4.word5"
@@ -45,8 +52,8 @@ let authMode
 if (window.location.pathname === '/auth/restricted/oidc') {
   authMode = 'oidc'
 } else {
-  // Both iframe and forward auth use hash params for mode (forbidden/login/reauth)
-  authMode = ['reauth', 'forbidden'].includes(hashParams.get('mode')) ? hashParams.get('mode') : 'login'
+  // Both iframe and forward auth use hash params for mode (forbidden/login/reauth/profile)
+  authMode = ['reauth', 'forbidden', 'profile'].includes(hashParams.get('mode')) ? hashParams.get('mode') : 'login'
 }
 
 function postToParent(message) {
@@ -74,6 +81,12 @@ function handleBack() {
   })
 }
 
+function handleLogout() {
+  postToParent({
+    type: 'auth-logout'
+  })
+}
+
 onMounted(() => {
   // Check for remote auth token in URL
   remoteAuthToken.value = extractRemoteToken()