feat(profiles): add profile_assets as the canonical owned asset join

[willgriffin]

Parent epic: #1063

Summary

Add profile_assets as the canonical owned asset join for Profile records.

This should cover people, organizations, and bots through the shared Profile primitive rather than splitting asset ownership across STI subclasses.

Why

• Person, Organization, and Bot are STI subclasses of Profile
• profile media is primitive-owned, not a generic/provenance association
• this keeps ownership aligned with the same rule as content_assets

Scope

• add ProfileAsset model with tableName: 'profile_assets'
• add ProfileAssetCollection
• support profileId, assetId, relationship, sortOrder, and tenant scoping as appropriate
• add helpers on Profile / ProfileCollection for attaching, listing, and removing assets
• add tests and docs

Examples

• avatar
• headshot
• logo for organization profiles
• resume / portfolio assets

Done when

• Profile has a canonical owned asset join table
• profile-owned media no longer requires generic AssetAssociation