[shrsv]

Summary

• Replaces the bare logout icon in the navbar with an account menu: a deterministic avatar (stable initials + color, hashed from the user's id/email so it never changes across sessions) that opens a popover with "Profile and preferences", "Change password", "API keys", and "Sign out".
• Adds a self-service Account tab at /settings#account (visible to every authenticated user, no org-role gate) for editing your own name and changing your password, backed by the existing PUT /users/profile and PUT /users/password endpoints.
• Hardens those two endpoints, since this PR is their first real caller: they're now session-only (API keys are rejected, per the "sensitive account actions require a JWT session" rule) and their DB write + audit event now commit atomically in one transaction (previously unaudited and reachable via API key despite being credential changes).
• Fixes the organization selector: the current org is now pinned in its own "Current organization" section at the top of the switcher (previously highlighted wherever it happened to fall in the list), and role labels render properly ("Super Admin" instead of CSS-capitalized "Super_admin") — fixed consistently everywhere an org role string is rendered (org selector + 3 User Management views).
• Adds a "My Account" group to the Settings mega menu, and a routes_guide doc for the new tab.

Checks run locally (mirroring CI)

• make testall — all Go tests pass
• npx tsc --noEmit — clean
• gofmt -l on changed files — clean
• go vet on touched packages — clean (one pre-existing unreachable-code warning in internal/api/middleware/selfhosted_enforcement.go, unrelated to this change)
• make security-govulncheck — no vulnerabilities
• make security-osv — 0 results
• make security-gitleaks — no leaks found (2384 commits scanned)
• make security-semgrep — 0 findings (1817 rules / 2311 files)

Test plan

• Open the navbar account menu, confirm the avatar shows stable initials/color across reloads.
• Update your name on /settings#account, confirm it reflects immediately in the navbar avatar/name.
• Change your password via the same tab, confirm the old password fails and the new one works.
• Confirm PUT /users/profile / PUT /users/password are rejected (403) when called with an API key instead of a session.
• Open the organization switcher with multiple orgs, confirm the current org is pinned at the top and role labels read "Super Admin" / "Owner" / "Member".

---

🔍 LiveReview

• ▶️ Start a review: reviews all changes in this PR against its target branch
• 📜 Review history: all past reviews of this PR

⚙️ Customize risk-based approval policy for this repository or your organization.