Added reading profile endpoint

API.md

@@ -6,14 +6,18 @@ Base URL: `http://localhost:${PORT}`. Use `Authorization: Bearer <token>` on eve
 |---|---:|---|---|
 | `POST /auth/register` | no | JSON: `name`, `username`, `email`, `password` | `201 {id}`; strict fields; see password policy below |
 | `POST /auth/login` | no | JSON: `email`, `password` | `200 {id,token,expires_at}`; `401` is generic |
+| `GET /profiles/me` | yes | no body/query | `200 {id,name,username}` for the token user |
+| `GET /profiles/:id` | yes | no body/query | `200 {id,name,username}`; email/password are never exposed |
 | `GET /posts` | yes | no body/query | `200` all posts; ownership does not limit viewing |
-| `GET /posts/me` | yes | no body/query | `200` only posts with `author_id = token.user_id` |
+| `GET /posts/me` | yes | no body/query | `200` only posts with `author_id = token.user_id`; each includes `author_username` |
 | `GET /posts/image/:filename` | yes | no body/query | Authenticated image download |
 | `POST /posts/create` | yes | multipart fields: `title`, `text`; optional file `image` | `201` post; `author_id` always comes from token |
 | `PUT /posts/edit?id=<id>` | yes + owner | multipart: optional `title`, `text`, `image`, `remove_image=true\|false` | `200` updated post; upload replaces image; `remove_image=true` clears it; image + remove is invalid |
 | `DELETE /posts/delete?id=<id>` | yes + owner | query: `id` only | `200`; deletes only matching `id AND author_id` and removes stored image |
 | `POST /create_relationship?me=<id>&them=<id>` | yes | query: `me`, `them` only | `200`; `me` must equal token user ID |
 
+Post objects include `author_username` and `created_at` (the database creation timestamp), joined from `people.username`; the join is left-sided so an orphaned post is not silently omitted.
+
 ## Input rules
 
 - Any undocumented body or query field returns `400`; do not send `author_id` to create posts.