Self-service profile and federated roles

Users manage their own profile and avatar from the shell. Module roles are now assigned centrally in the Nucleo identity service and enforced by each module — one place to govern who can do what, everywhere.

Google Workspace user sync moved into the identity service as well, so provisioning and off-boarding happen once, platform-wide.