Profile-generation API: trigger tech-lead session, propose, human-confirm before write

[Ryan-Atkinson87]

Profile-generation API: trigger the tech-lead profile-generation session, return the proposed execution profile, and write it only on human confirmation.

Spec: §17.5 project execution profile, §15 (profile-generation UX is a phase-6 detail), §3.4.

Acceptance criteria

• Endpoint to trigger the tech-lead profile-generation session (Tech-lead profile-generation session (propose execution-profile, human-confirm before write) #23) for a project and return the proposed execution-profile.yaml for human review (§17.5).
• A separate confirm endpoint writes the proposed profile only after explicit human confirmation; nothing is written before then (§17.5 human-confirm-before-write).
• The session is invoked through the provider adapter (Implement Claude provider adapter via Claude Agent SDK #17), not a direct SDK call (§3.3); the API orchestrates the propose→confirm→write flow deterministically (Principle 1).
• Behind the auth dependency (Single-user auth: argon2 password, session cookie, route/SSE guard #6); explicit success/failure paths; a rejected/abandoned proposal writes nothing.
• Contract documented and verified per workflow-api-contract-verification for the profile-generation screen (Profile-generation screen: trigger session, review proposed profile, confirm before write #68).
• Tests with the session mocked: propose returns a profile without writing; confirm writes; reject writes nothing; auth enforced.

Depends on: #23, #2