Harden auth and API: username change, 2FA fixes, input validation

- Add POST /api/auth/change-username (password + OTP when 2FA is on,
  format/reserved-name checks, uniqueness) and a Change Username modal
  in Account.vue; use the real username for the 2FA provisioning URI.
- Stop creating the built-in admin/password user; the initial admin is
  seeded only from OVPMON_INITIAL_ADMIN_USER/PASSWORD.
- Reject 2FA-pending temporary tokens on all protected routes (Flask
  token_required, Profiler verify_token); only /api/auth/verify-2fa
  accepts them.
- Stop logging the OTP and TOTP secret in enable_2fa.
- Profiler: validate profile username (pattern + realpath checks in
  schema, router, pki and generator) to prevent path traversal.
- Restrict CORS to the panel origin in Profiler and Flask APIs.
- UI: header username no longer sticks to the hardcoded Admin fallback;
  it is synced from /user/me and updated after a rename.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

APP_PROFILER/routers/profiles.py

@@ -79,6 +79,11 @@ def create_profile(
     if existing:
         raise HTTPException(status_code=400, detail="User already exists")
     
+    try:
+        pki.validate_username(profile_in.username)
+    except ValueError:
+        raise HTTPException(status_code=400, detail="Invalid username")
+
     # Build PKI
     try:
         pki.build_client(profile_in.username, db)
@@ -89,6 +94,9 @@ def create_profile(
     client_conf_dir = "client-config"
     os.makedirs(client_conf_dir, exist_ok=True)
     file_path = os.path.join(client_conf_dir, f"{profile_in.username}.ovpn")
+    base_real = os.path.realpath(client_conf_dir)
+    if not os.path.realpath(file_path).startswith(base_real + os.sep):
+        raise HTTPException(status_code=400, detail="Invalid username")
     
     try:
         generator.generate_client_config(db, profile_in.username, file_path)