feat: add public user profiles

backend/test/app.test.ts

@@ -173,6 +173,48 @@ test("GET /api/races requires authentication", async () => {
   assert.equal(res.body.error, "unauthorized");
 });
 
+test("public profile exposes only its owner's calendar after they enable it", async () => {
+  const { agent } = await authAgent();
+  const user = await agent.get("/api/auth/me").expect(200);
+  const userId = user.body.user.id as string;
+  await agent
+    .post("/api/races")
+    .set("X-CSRF-Token", user.body.csrfToken as string)
+    .send({
+      slug: "2026-08-01-public-race",
+      date: "2026-08-01",
+      title: "Public Race",
+      distanceKm: 10,
+      notes: "Private note",
+      bibNumber: "123",
+      finishTime: "00:40:00",
+    })
+    .expect(201);
+
+  await request(app).get(`/api/users/${userId}/races`).expect(404);
+  await agent
+    .patch("/api/auth/profile")
+    .set("X-CSRF-Token", user.body.csrfToken as string)
+    .send({ isProfilePublic: true })
+    .expect(200);
+
+  const publicRaces = await request(app).get(`/api/users/${userId}/races`).expect(200);
+  assert.deepEqual(publicRaces.body, [{
+    date: "2026-08-01",
+    title: "Public Race",
+    distanceKm: 10,
+    status: null,
+    coverImageUrl: null,
+  }]);
+
+  await agent
+    .patch("/api/auth/profile")
+    .set("X-CSRF-Token", user.body.csrfToken as string)
+    .send({ isProfilePublic: false })
+    .expect(200);
+  await request(app).get(`/api/users/${userId}/races`).expect(404);
+});
+
 test("login uses generic response for missing user and wrong password", async () => {
   const password = "correct horse battery staple";
   await createVerifiedUser("generic@example.com", password);