[DX] Pre-built profile templates

Goal

Drop-in starting points for the common deployment shapes.

What to ship

examples/profiles/ directory with annotated, paste-ready profiles:

• local-dev.json — single-profile, connection-string, all tiers.
• prod-readonly.json — Entra, allowedRoles: ["read"], scoped to one db.
• support-agent.json — Entra, allowedRoles: ["read","write"], scoped to support data.
• analytics-readonly.json — Entra, allowedRoles: ["read"], broad db access, deniedCollections: { *: ["audit_log","pii"] }.
• locked-down.json — Entra, allowedRoles: ["read"], single db, single collection.

Each file has a header comment explaining what it permits and why.

Acceptance criteria

• Every template passes --validate.
• README's auth/profiles section links to examples/profiles/.
• Templates demonstrate every field operators actually need (allowedRoles, allow/deny lists, readOnly if it survives PR #47).

Why

Solves the I don't know how to write allowedRoles problem. Operators learn by copying, not by reading docs.

Start with the README auth/profiles section and the existing profile validation path that supports --validate. Add the five annotated files under examples/profiles/, then verify every template passes --validate and that the README links to the directory. Check PR #47 before including readOnly, as the acceptance criteria make that field conditional.