feat(admin): per-user profile view + rebuild action (#81 phase B.1)

Surfaces phase A's profile features in /admin/users/:id so we can verify
they're actually computing useful values before investing in bandit
consumption. The detail GET now includes profile rows joined with registry
metadata (name, value, age, fresh badge, ttlSec, description). Read does
NOT trigger compute — staleness must be visible. A new POST
.../profile/rebuild button force-recomputes and is audit-logged like
reset-bandit.

Refs #81.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

services/api/src/profile/builder.ts

@@ -105,3 +105,53 @@ export function readProfile(userId: string): Profile {
   for (const [name, row] of stored) out[name] = valueOf(row);
   return out;
 }
+
+export interface ProfileFeatureView {
+  name: string;
+  value: number | string | null;
+  /** When the row was last computed; null if not stored yet. */
+  updatedAt: string | null;
+  /** Seconds since updatedAt; null if not stored. */
+  ageSec: number | null;
+  /** Whether the row is within its TTL window (false also when not stored). */
+  fresh: boolean;
+  ttlSec: number;
+  dtype: 'numeric' | 'categorical';
+  description: string;
+}
+
+/**
+ * Inspection helper for the admin UI: returns one row per registered feature,
+ * joining stored value + metadata. No compute — surface staleness; rebuild is
+ * a separate explicit action so reading a user doesn't quietly refresh state.
+ */
+export function inspectProfile(userId: string): ProfileFeatureView[] {
+  const stored = readStored(userId);
+  const now = Date.now();
+  return FEATURES.map((f) => {
+    const row = stored.get(f.name);
+    if (!row) {
+      return {
+        name: f.name,
+        value: null,
+        updatedAt: null,
+        ageSec: null,
+        fresh: false,
+        ttlSec: f.ttlSec,
+        dtype: f.dtype,
+        description: f.description,
+      };
+    }
+    const ageSec = (now - new Date(row.updated_at).getTime()) / 1000;
+    return {
+      name: f.name,
+      value: valueOf(row),
+      updatedAt: row.updated_at,
+      ageSec: Math.max(0, ageSec),
+      fresh: isFresh(row, now),
+      ttlSec: f.ttlSec,
+      dtype: f.dtype,
+      description: f.description,
+    };
+  });
+}