feat: add user_id index to profiles table for faster lookups

The profiles table previously lacked an index on the user_id column, causing full table scans during user lookups. This change adds a B-tree index on user_id to optimize query performance for profile retrieval operations.

.claude/commands/audit-event.md

@@ -0,0 +1,15 @@
+---
+description: Add an audit-log event end to end - the events.md catalogue key, the category_for mapping, and the recorder call at the mutation point.
+argument-hint: <event.key for which mutation>
+allowed-tools: Read, Grep, Edit, Bash(python *)
+---
+Add the audit event for: **$ARGUMENTS**
+
+Follow the audit-log design (`devplacepy/services/audit/`); confirm against the source first.
+
+1. Pick or extend the event key in `events.md` (the authoritative catalogue at the repo root) in the correct domain.
+2. If it is a NEW domain, extend `category_for` in `devplacepy/services/audit/categories.py`.
+3. Call the recorder on the mutation's success path: `audit.record(request, event_key, ...)` in HTTP or WebSocket handlers, or `audit.record_system(event_key, ...)` in request-less contexts (services, jobs, CLI). On a guard or denial branch pass `result="denied"`; on a failure branch pass `result="failure"`.
+4. Route through the existing DRY choke point when one applies (`content.py`, the `project_files.py` helpers, `routers/containers.py` `_audit_instance`, the Devii dispatcher `_audit_mechanic`) instead of scattering call sites. The HTTP path and the Devii path for one mutation must stay disjoint (no double counting).
+5. Recording is best-effort: wrap nothing the caller depends on, and NEVER gate the audited action on the record succeeding.
+6. Validate with `python -m agents.validator` on the touched files and `python -c "from devplacepy.main import app"`.