fix(cc-config): one account is one profile, and rename it in place

Four defects, all from one design mistake: a profile's display name and its
filename were the same string.

- Saving the logged-in account made a SECOND profile of an account another
  profile already held. Both then reported themselves active, so there was
  nothing to switch between. `POST /profiles` now refuses `EDUPLICATE` and
  names the profile that already holds the account. Re-saving into the
  account's own profile stays allowed - that is the token-refresh path.
- Worse, an accidental duplicate could not be cleaned up: two profiles of one
  account are both active, and the delete guard refused any active profile, so
  neither was ever deletable. The guard now blocks only the LAST saved copy of
  the live account, which is the actual credential-loss condition it exists
  for. The trash button had to follow, or the server would allow what the UI
  hid.
- A name could not contain spaces or diacritics, because it had to be
  filename-safe. A profile now carries `name` (internal identifier, still the
  filename, still what every route takes) and `label` (what the user reads and
  edits: 1-60 free-form characters, control characters rejected, stored
  trimmed, unique case-insensitively). A label never touches a path, which is
  what makes "Tài khoản chính" a legal name.
- Naming happened up front in a "save current account as" field. That field is
  gone. The server derives the identifier, the save button lives on the live
  account's card and appears only while it is unsaved, and the label is edited
  by clicking it (Enter saves, Escape cancels).

Renaming rewrites the label in place and deliberately does NOT move `name`, so
it cannot half-fail and leave a profile unreachable. Profiles written before
labels existed report `label` equal to their `name`, so nothing needs migrating.

Adds `PATCH /api/cc-config/profiles`; `POST` now takes an optional `name`.

Verified: server 1431/1431 (11 new), client 459/459, tsc clean. Also exercised
end to end against a COPY of the real profile store on this machine: the
duplicate deleted, the last copy still refused, a Vietnamese label accepted,
and the stored access/refresh tokens and 0600 mode intact after a rename.

server/__tests__/cc-profiles.test.js

@@ -195,6 +195,125 @@ describe("cc-profiles", () => {
     assert.throws(() => profiles.deleteProfile("work"), { code: "ENOTFOUND" });
   });
 
+  it("refuses to save an account that is already saved under another name", () => {
+    login("uuid-a", "a@example.com");
+    profiles.saveProfile("work");
+    assert.throws(() => profiles.saveProfile("work-again"), { code: "EDUPLICATE" });
+    // The rejected name left no file behind.
+    assert.deepEqual(
+      profiles.listProfiles().items.map((p) => p.name),
+      ["work"]
+    );
+  });
+
+  it("names the profile that already holds the account, so the error is actionable", () => {
+    login("uuid-a", "a@example.com");
+    profiles.saveProfile("work");
+    assert.throws(() => profiles.saveProfile("dup"), /work/);
+  });
+
+  it("still re-snapshots an account into its own existing profile", () => {
+    login("uuid-a", "a@example.com");
+    profiles.saveProfile("work");
+    assert.equal(profiles.saveProfile("work").name, "work");
+  });
+
+  it("derives a filename-safe slug and a readable label when no name is given", () => {
+    login("uuid-a", "trí.vĩ@example.com");
+    const saved = profiles.saveProfile();
+    assert.match(saved.name, /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/);
+    const item = profiles.listProfiles().items[0];
+    assert.equal(item.name, saved.name);
+    assert.ok(item.label, "a saved profile always has a label to show");
+  });
+
+  it("labels an existing profile by its name when the file predates labels", () => {
+    login("uuid-a", "a@example.com");
+    profiles.saveProfile("work");
+    const file = path.join(profiles.profilesDir(), "work.json");
+    const stored = JSON.parse(fs.readFileSync(file, "utf8"));
+    delete stored.label;
+    fs.writeFileSync(file, JSON.stringify(stored));
+    assert.equal(profiles.listProfiles().items[0].label, "work");
+  });
+
+  it("renames a profile's label, keeping its credentials and its identifier", () => {
+    login("uuid-a", "a@example.com");
+    profiles.saveProfile("work");
+    const result = profiles.renameProfile("work", "Tài khoản chính");
+    assert.equal(result.name, "work");
+    assert.equal(result.label, "Tài khoản chính");
+
+    const item = profiles.listProfiles().items[0];
+    assert.equal(item.name, "work", "the identifier must not change under a rename");
+    assert.equal(item.label, "Tài khoản chính");
+    assert.equal(item.email, "a@example.com");
+    // Switching still works, so the credentials survived the rewrite.
+    login("uuid-b", "b@example.com");
+    profiles.saveProfile("personal");
+    profiles.activateProfile("work");
+    assert.equal(JSON.parse(fs.readFileSync(CREDS, "utf8")).claudeAiOauth.accessToken, "at-uuid-a");
+  });
+
+  it("accepts spaces and diacritics in a label but not control characters", () => {
+    login("uuid-a", "a@example.com");
+    profiles.saveProfile("work");
+    for (const good of ["Tài khoản chính", "Work / Personal", "công ty ⭐", "a b"]) {
+      assert.equal(profiles.renameProfile("work", good).label, good);
+    }
+    for (const bad of ["", "   ", "a\nb", "a\tb", "x".repeat(61), 5, null]) {
+      assert.throws(
+        () => profiles.renameProfile("work", bad),
+        { code: "EBADLABEL" },
+        `took ${bad}`
+      );
+    }
+  });
+
+  it("trims a label rather than storing the padding", () => {
+    login("uuid-a", "a@example.com");
+    profiles.saveProfile("work");
+    assert.equal(profiles.renameProfile("work", "  Chính  ").label, "Chính");
+  });
+
+  it("refuses a label another profile already uses, case-insensitively", () => {
+    login("uuid-a", "a@example.com");
+    profiles.saveProfile("work");
+    login("uuid-b", "b@example.com");
+    profiles.saveProfile("personal");
+
+    profiles.renameProfile("work", "Chính");
+    assert.throws(() => profiles.renameProfile("personal", "chính"), { code: "ELABELTAKEN" });
+    // Renaming a profile to the label it already has is not a conflict.
+    assert.equal(profiles.renameProfile("work", "Chính").label, "Chính");
+  });
+
+  it("refuses to rename a profile that does not exist", () => {
+    login("uuid-a", "a@example.com");
+    assert.throws(() => profiles.renameProfile("nope", "X"), { code: "ENOTFOUND" });
+  });
+
+  it("deletes a duplicate of the live account while another copy still holds it", () => {
+    // The state a pre-EDUPLICATE save could leave behind: two profiles, one
+    // account, both flagged active — and with a blanket active-guard, neither
+    // deletable. Cleanup has to be possible.
+    login("uuid-a", "a@example.com");
+    profiles.saveProfile("work");
+    const dup = path.join(profiles.profilesDir(), "work-copy.json");
+    fs.copyFileSync(path.join(profiles.profilesDir(), "work.json"), dup);
+
+    assert.deepEqual(
+      profiles.listProfiles().items.map((p) => [p.name, p.active]),
+      [
+        ["work", true],
+        ["work-copy", true],
+      ]
+    );
+    assert.deepEqual(profiles.deleteProfile("work-copy"), { ok: true, name: "work-copy" });
+    // The last copy of the live account is still protected.
+    assert.throws(() => profiles.deleteProfile("work"), { code: "EACTIVE" });
+  });
+
   it("skips corrupt profile files instead of failing the whole list", () => {
     login("uuid-a", "a@example.com");
     profiles.saveProfile("work");