feat: implement profile CRUD validation compatibility and defaults API

- Add ConfigProfile CRUD endpoints with user ownership and access checks
- Implement ordered include management with cycle detection
- Add mount management with path validation (absolute, no traversal)
- Implement compatibility-filtered listing by tool type
- Add default profile selection APIs (get/set defaults per tool type)
- Fix SQLAlchemy ambiguous foreign key relationships in config models
- Add comprehensive integration tests (29 tests, all passing)
- Merge upstream profile resolver service changes (task 2.1)

apps/api/src/models/config_profile.py

@@ -45,13 +45,14 @@ class ConfigProfile(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     tool_type: Mapped["ToolType | None"] = relationship()
     includes: Mapped[list["ConfigInclude"]] = relationship(
         "ConfigInclude",
-        foreign_keys="ConfigInclude.profile_id",
+        primaryjoin="ConfigProfile.id == ConfigInclude.profile_id",
         back_populates="profile",
         cascade="all, delete-orphan",
         order_by="ConfigInclude.order_index",
     )
     mounts: Mapped[list["ConfigMount"]] = relationship(
         "ConfigMount",
+        primaryjoin="ConfigProfile.id == ConfigMount.profile_id",
         back_populates="profile",
         cascade="all, delete-orphan",
         order_by="ConfigMount.order_index",