HostProfileView now renders the same centered frame card as the login flows, whether shown full-page at /auth/ (host mode) or inside the new #mode=profile restricted iframe. The component self-fetches its data when the parent does not provide it, and emits back/logout so each context reacts appropriately: the full page reloads, the iframe posts auth-back / auth-logout to the host.