feat: replace mock user helpers with Prisma-backed profile API

- Add firstName, lastName, bio, avatar fields to User model in Prisma schema
- Add LearnerProfile model with display name, country, timezone, languages,
  skill level, interests, goals, and visibility/consent controls
- Add OnboardingState model tracking profile completion, email verification,
  wallet connection, session booking, credential earning, and consent
- Create user.service.ts with Prisma-backed methods:
  - findUserById with profile, onboarding, and profile completion
  - updateUserProfile with audit logging
  - updateUserProfileData for LearnerProfile upsert
  - validatePassword using bcrypt.compare
  - updateUserPassword using bcrypt hash
  - updateUserWallet with onboarding state update
  - getPublicProfile with consent-aware visibility check
  - getProfileCompletion and getOnboardingState
- Update UserController to use service instead of mock helpers
- Add audit logging for PROFILE_UPDATED, PASSWORD_CHANGED, WALLET_UPDATED
- Add public profile read respecting LearnerProfile visibility
- Return profileCompletion and onboardingState in user responses
- Add GET /me/profile route for extended profile
- Update tests to mock Prisma instead of spying on private methods
- All 318 tests pass, TypeScript compiles cleanly

Closes: #85

Author: dimka90

package.json

@@ -75,6 +75,9 @@
     "typescript-eslint": "^8.56.0",
     "vitest": "^4.0.18"
   },
+  "pnpm": {
+    "onlyBuiltDependencies": ["@prisma/engines", "prisma", "esbuild"]
+  },
   "packageManager": "pnpm@10.0.0",
   "prisma": {
     "seed": "tsx prisma/seed.ts"

prisma/schema.prisma

@@ -11,12 +11,18 @@ model User {
   email           String         @unique
   username        String         @unique
   password        String
+  firstName       String?
+  lastName        String?
+  bio             String?
+  avatar          String?
   role            Role           @default(LEARNER)
   walletAddress   String?        @unique
   isVerified      Boolean        @default(false)
   createdAt       DateTime       @default(now())
   updatedAt       DateTime       @updatedAt
   lastLoginAt     DateTime?
+  profile         LearnerProfile?
+  onboarding      OnboardingState?
   completions     Completion[]
   credentials     Credential[]
   transactions    Transaction[]
@@ -35,6 +41,45 @@ model User {
   @@map("users")
 }
 
+model LearnerProfile {
+  id            String   @id @default(uuid())
+  userId        String   @unique
+  user          User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  displayName   String?
+  country       String?
+  timezone      String?
+  languages     String   @default("[]")  // JSON array
+  skillLevel    String?  // beginner, intermediate, advanced
+  interests     String   @default("[]")  // JSON array
+  goals         String   @default("[]")  // JSON array
+  visibility    String   @default("public")  // public, private, mentor_only
+  consentGiven  Boolean  @default(false)
+  consentAt     DateTime?
+  createdAt     DateTime @default(now())
+  updatedAt     DateTime @updatedAt
+
+  @@map("learner_profiles")
+}
+
+model OnboardingState {
+  id                      String   @id @default(uuid())
+  userId                  String   @unique
+  user                    User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  profileComplete         Boolean  @default(false)
+  emailVerified           Boolean  @default(false)
+  walletConnected         Boolean  @default(false)
+  firstSessionBooked      Boolean  @default(false)
+  firstCredentialEarned   Boolean  @default(false)
+  consentProvided         Boolean  @default(false)
+  completedSteps          String   @default("[]")  // JSON array of step keys
+  currentStep             String   @default("welcome")
+  dismissed               Boolean  @default(false)
+  createdAt               DateTime @default(now())
+  updatedAt               DateTime @updatedAt
+
+  @@map("onboarding_states")
+}
+
 model Session {
   id           String    @id @default(uuid())
   userId       String