feat: create managed profiles atomically

- Require a fresh cookie MFA proof before creation\n- Create the credential-less profile and initial Guardian grant together

tests/integration/managed-profile-lifecycle.test.ts

@@ -131,7 +131,7 @@ describe("managed profile lifecycle (real Postgres)", () => {
     expect(profile.dateOfBirth).toBeNull();
   });
 
-  it("rolls the profile back when creating its Guardian grant fails", async () => {
+  it("creation rolls the profile back when its Guardian grant fails", async () => {
     await signInWithFreshMfa();
     const prisma = getPrismaClient();
     await prisma.$executeRawUnsafe(