feature: profile avatar opens a user-menu dropdown instead of signing out (COG-1060)

[hannahhkyme]

Summary

Fixes COG-1060: a user reported that clicking the profile icon sends them to the login page. The sidebar user block's only control was a bare LogOut icon button next to the avatar, so a click there called logout() → window.location.href = "/login". The header showed the user's name as plain text with no menu.

New UserMenu (frontend/client-app/src/components/ui/user-menu.tsx): avatar-initials trigger (aria-haspopup="menu") that opens a dropdown with the user's name/email, Settings (/settings) and Sign out. Closes on outside click, Escape, or after picking an item. Props: align, placement, variant: "light" | "dark", plus children rendered next to the avatar inside the trigger.

• Sidebar footer: replaced avatar + logout-icon with <UserMenu variant="dark" align="left" placement="top">; now also rendered when the sidebar is collapsed (avatar only).
• AppShell header: the plain displayName span is now inside <UserMenu> so the header has a real profile control too.

Keyboard: opening focuses the first item (ArrowUp on the trigger opens at the last item); ArrowUp/Down wrap, Home/End jump, Escape closes and restores focus to the trigger, Tab / focus leaving closes.

Sign-out now only happens via the explicit menu item.

Screenshots

Sidebar menu:

Header menu:

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/a7e415f08015474cbc674e74905cdc4c
Open in Devin Desktop: https://app.devin.ai/desktop/session/a7e415f08015474cbc674e74905cdc4c?variant=devin
Requested by: @hannahhkyme

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Profile menu runtime verification

Tested the PR frontend in desktop Chrome at localhost:3001 (Vite from source) against the local gateway.

• Sidebar and header avatar/name clicks open the dropdown without signing out.
• Both Settings items navigate to /settings and close the menu.
• Outside click and Escape dismiss; Escape restores trigger focus.
• Collapsed-sidebar avatar remains usable.
• ArrowDown/ArrowUp opening, wrapping, Home/End, and Tab dismissal work.
• Explicit Sign out lands on /login and clears both stored tokens; refresh remains signed out.

Sidebar dropdown	Header dropdown

Additional evidence and scope

Collapsed sidebar	Explicit sign-out

No failures in the planned checks. Other browsers and mobile were not tested.