I replaced the settings experience with a dedicated central panel that opened from the chat avatar menu, and I wired section-scoped actions for display name, email, password, photo, theme, and account deletion with disabled-save guards and inline status rendering. I moved the profile menu trigger to the chat top-right avatar and kept settings state in AppState so updates were applied through explicit async events instead of ad hoc UI mutations. For auth reliability, I fixed the login 404 by switching password sign-in to /auth/v1/token?grant_type=password and sending Content-Type, apikey, and Authorization bearer publishable-key headers expected by GoTrue. I implemented profile persistence against a public.profiles table keyed by auth.users.id with display_name, avatar_url, theme, and updated_at fields, and I used PATCH calls for targeted updates plus storage object upload for avatars. I tightened database security with explicit RLS policies for select, insert, and update using auth.uid() = id, and I documented a backfill query for existing auth users that were missing profile rows. I removed the client-side profile ensure-insert path that had produced 403/42501 errors and returned clear errors when a PATCH matched zero rows so missing-profile setup was diagnosable. I also cleaned compiler warnings by adding #[allow(dead_code)] on model_cache, #[allow(dead_code)] on upsert_profile, and a module-level #![allow(dead_code)] in model_metadata to silence currently unwired cache constants, enum variants, struct fields, and helper methods without changing runtime behavior.