Profile Active internal

Metadata only in this phase — no files here. Cookie-authenticated via the same-origin proxy.