fix: move profile_router registration before frontend catch-all route (#563)

[ionfwsrijan]

Description

Route registration order in backend/app/main.py:

1. API routers registered under /api/v1 (lines ~247–252)
2. Frontend catch-all /{full_path:path} (line ~316)
3. app.include_router(profile_router) (was at line ~355)

FastAPI/Starlette matches routes in registration order. The route /{full_path:path} matches any URL path for GET/HEAD requests. Since profile_router was registered after it, all profile endpoints (GET /profile, PUT /profile, POST /profile/avatar) were never reached — the catch-all returned frontend SPA HTML instead.

The condition if os.path.exists(FRONTEND_BUILD_DIR): meant this bug only existed in production/Docker. In development with no frontend build, the catch-all was not registered and profile routes worked fine — creating a dev/prod inconsistency.

Changes

backend/app/main.py

• Moved app.include_router(profile_router) from after the frontend catch-all (line 355) to join the other API route registrations (line 253), so profile endpoints are registered before the catch-all and are reachable in production/Docker.

Impact

• Profile endpoints now return correct JSON responses instead of frontend HTML in production
• Development and production behavior is now consistent
• No silent failures from the SPA swallowing wrong responses

Closes #563

[ionfwsrijan]

@param20h Please review this