feat(auth) : sync Sudloh profiles and validate sessions

app/api/profile/route.test.ts

@@ -7,9 +7,13 @@ const returning = vi.fn();
 const where = vi.fn(() => ({ returning }));
 const set = vi.fn(() => ({ where }));
 const write = vi.fn();
+const linkedAccounts = vi.fn();
 
 vi.mock("@/lib/commission/server", () => ({ requireCommissionUser }));
-vi.mock("@/db", () => ({ getDb: () => ({ update: () => ({ set }) }) }));
+vi.mock("@/db", () => ({ getDb: () => ({
+  update: () => ({ set }),
+  select: () => ({ from: () => ({ where: () => ({ limit: linkedAccounts }) }) }),
+}) }));
 vi.mock("@/lib/media/storage", () => ({ getMediaStorage: async () => ({ write }), publicMediaUrl: (key: string) => `https://cdn.test/${key}` }));
 vi.mock("@/lib/security/rate-limit", () => ({ limitRequest: async () => undefined }));
 
@@ -27,6 +31,7 @@ describe("profile update", () => {
     process.env.BETTER_AUTH_URL = "https://guide.sudloh.com";
     vi.clearAllMocks();
     requireCommissionUser.mockResolvedValue({ id: "user-1", image: null });
+    linkedAccounts.mockResolvedValue([]);
     returning.mockResolvedValue([{ name: "New Name", image: null }]);
   });
 
@@ -60,4 +65,10 @@ describe("profile update", () => {
     expect((await POST(profileRequest("New Name"))).status).toBe(401);
     expect(set).not.toHaveBeenCalled();
   });
+
+  it("sends Sudloh-linked users to Sudloh for profile changes", async () => {
+    linkedAccounts.mockResolvedValueOnce([{ id: "sudloh-account" }]);
+    expect((await POST(profileRequest("New Name"))).status).toBe(403);
+    expect(set).not.toHaveBeenCalled();
+  });
 });