/profile shows the signed-in member's account and — where the deployment
asks for the permission — edits the two fields Ponente itself displays:
the display name and the avatar. It is the standard
app.bsky.actor.profile record at rkey "self", written with
com.atproto.repo.putRecord and uploadBlob, so a name set here is the name
every app on the network shows.

The permission is the interesting part. The narrowest scope the OAuth
specification can express for this is repo:app.bsky.actor.profile plus
blob:image/*, and no account server accepts it yet: measured today,
bsky.social and this deployment's own PDS both advertise only "atproto"
and the three transition:* scopes, and an unknown scope is rejected
rather than narrowed — so asking for it would break sign-in for everyone.
The only scope that works is transition:generic, which covers the whole
account. That trade belongs to the deployment, so it is
AtProto:ProfileScope (none | granular | generic), defaulting to none: the
page then still shows the account and refreshes Ponente's cached copy of
it, and says why the fields are missing. ProfileScope carries the
reasoning and docs/auth.md carries the measurement.

Also here: the record is merged as JSON rather than round-tripped through
a typed model, so a description, a banner or the self-labels behind "no
logged-out visibility" survive a rename; swapRecord makes a concurrent
change a message instead of an overwrite; MemberService gains
SetProfileAsync beside the renamed RefreshProfileAsync, because a member
clearing their own name means it and a lookup finding nothing does not;
and BoardNotifier.ProfileChanged lets the nav header replace the face in
the corner without a reload.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

@@ -0,0 +158,4 @@
+                    editable);
+            }
+
+            return new ProfileView(did, handle, null, null, client.PdsUrl, editable);