Add account console + author Person JSON-LD

#47 in Riparion/riparion-cms — merged 2026-06-02

What

A self-service account console plus the full author Person JSON-LD pipeline (implements TODO_JSONLD_AUTHOR.md Phases 1–3).

Account console (src/pages/console/, src/pages/auth.rs)

• Three sections behind a shared sidebar shell, gated by RequireAuth: Account (arium AccountSettings), Profile (new), Two-factor (arium MfaSetup, split onto its own page).
• New SidebarShell in layouts.rs factors out the sidebar/inset chrome shared with the admin AdminShell; each console supplies its own gate (RequirePermission vs RequireAuth), nav items, and optional header extra.

Profile editor + persistence (src/server/authors.rs, src/db/authors.rs, src/model)

• get_my_profile / update_my_profile server fns (sign-in gated). Validates the avatar and each social URL via a lifted, shared server::is_valid_link_url (avatars allow /path or http(s); social links require absolute http(s)).
• bio + social links upsert into user_profiles; the avatar goes through arium's new auth::update_avatar setter instead of writing arium's users table directly.
• social_links stored as a JSON array; model::parse_social_links/encode_social_links (tolerant parser + unit tests) and a shared model::nonblank helper.

Author Person JSON-LD (src/pages/reader/jsonld.rs, feeds.rs)

• article() author Person enriched with description/image/sameAs.
• New author_profile() ProfilePage/Person builder emitted on /author/:username via use_server_future (crawler-visible SSR); the console Profile page renders a live preview through the same builder so it can't drift. Social links also render on the author page.

Other

• Header account dropdown reordered: Admin (top) / divider / Account / Sign out (Profile dropped from the header; reachable via the console sidebar).
• Seeds demo authors with bio/avatar/social links.

Dependency

Requires arium with auth::update_avatar (already on arium main); Cargo.lock pin bumped to 95fbd68.

Verification

• Builds on all three targets: server,sqlite, server,postgres, web/wasm.
• cargo fmt --check clean; clippy -D warnings clean on all three (CI flags).
• cargo test --features server,sqlite — model::social_links_tests (4) pass.
• Fresh-seed smoke test: demo authors' avatar/bio/social links persist; avatar routes through arium's setter.

🤖 Generated with Claude Code