Add privacy-safe cuber discovery and public profiles

## Goal

Help authenticated cubers find someone they already know or raced with and open a safe public profile before sending a friend request.

## MVP discovery contract

- Search only by normalized username and, when the target has explicitly enabled WCA identity visibility, WCA ID.
- Never search by email, ingest email for this feature, accept email as an identifier, or reveal whether an email exists.
- Require authentication, enforce bounded/rate-limited queries, and return a capped paginated result set.
- Respect blocks and profile visibility without telling a blocked user that a block caused an omitted result.
- Support entry points from the lobby user list, room users/times/chat, the friends hub, and direct username search.
- Do not add algorithmic stranger recommendations in the MVP.

## Public profile contract

Use one explicit server-side public projection containing only fields the viewer may see:

- stable public user identifier;
- display name and username;
- WCA identity and WCA-hosted avatar only when the target opted to reveal them;
- viewer-relative friend state: none, outgoing request, incoming request, or friends;
- relevant actions: request/cancel/accept/decline/unfriend/block and invite when eligible.

Do not reuse the editable `/profile` response for another user, and never include access tokens, email, hidden real name/WCA ID, private preferences, private-room membership, friend graph, or notification data.

## Acceptance criteria

- [ ] Add authenticated, indexed user search backed by #185's normalized username field.
- [ ] Add an authenticated public-profile endpoint and `/users/:id` client route with explicit field projection.
- [ ] Make user names/avatars open the public profile from existing lobby and room surfaces without breaking timer interaction or mobile layouts.
- [ ] Show correct viewer-relative friendship actions using #75 and handle concurrent/stale transitions.
- [ ] Return stable empty, not-found/unavailable, blocked, rate-limited, loading, and error states without user-enumeration leaks.
- [ ] Add server tests for every visibility combination, email-like queries, blocks, pagination, ID tampering, and unauthenticated access.
- [ ] Add client tests for hidden/visible WCA identity, friend states, keyboard accessibility, and responsive layouts.
- [ ] Add a two-user Cypress flow for search → profile → friend request.

## Dependencies

- #185 normalized username migration
- #191 email removal/purge
- #75 friendship lifecycle

## Deferred

- Opt-in language/timezone/event/pace matching is tracked in #190.
- Solve history, PBs, and rankings depend on the results-history work and are not required for this MVP.
- Public unauthenticated profiles are out of scope.