Wave 5A: /u house-mode public profile (D2)

Reserved house handle (default 'vyndr', env HOUSE_HANDLE) resolves to the
PUBLIC model record — getModelAggregate() with no userId (user_id=NULL rows)
— WITHOUT a public_profiles row. It is the ONLY special case; every other
handle keeps the private-by-default, byte-identical-404 no-existence-leak
contract. The house profile is always public and never 404s (a fetch failure
degrades to an honest building state).

- src/routes/profiles.js: house short-circuit + sendHouseProfile (public
  aggregate + by_tier + public settled entries), reserved before the publish
  lookup so a user claim is shadowed.
- PublicProfile.tsx: house label 'VYNDR MODEL · PUBLIC RECORD' + hero/subtitle
  off data.house; keeps the CLV-VERIFIED record hero + TierRecord calibration
  + recent settled reads (misses included).
- opengraph-image.tsx (1200x630): house-branded eyebrow/heading.
- portrait/route.tsx: new 1080x1350 share crop (real aggregate or tagline
  fallback, never a fabricated number).
- Discoverability: 'VIEW AS PUBLIC PAGE ->' on the ledger MODEL header +
  'VIEW PUBLIC RECORD ->' under the landing ModelRecord, both to /u/vyndr.
- tests/unit/houseProfile.test.js: house resolves to user_id=NULL aggregate
  (no public_profiles row) + by_tier; unknown/unpublished user handles stay
  byte-identical 404; page renders house label + TierRecord + portrait crop.

3019 tests green (3012 -> 3019); next build EXIT=0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

BACKEND_HANDOFF.md

@@ -242,6 +242,18 @@ Published only. Unknown AND unpublished return the SAME 404 body
 }
 ```
 
+### HOUSE profile (Wave 5A, D2)
+The reserved handle `HOUSE_HANDLE` (env, default `vyndr`) resolves to the
+PUBLIC model record (`getModelAggregate()` with NO userId → the `user_id=NULL`
+ledger rows) WITHOUT a `public_profiles` row, and is ALWAYS public (the
+partner-pitch weapon). Same response shape + two extra fields:
+`{ ..., house: true, label: 'VYNDR MODEL · PUBLIC RECORD' }`. Entries are the
+public settled rows (`user_id IS NULL`, misses included). Reserved before the
+publish lookup — a user who claims it is shadowed. Every OTHER handle keeps the
+private-by-default, byte-identical-404 contract. It never 404s (a fetch failure
+degrades to an honest empty/building state). Portrait share crop: route handler
+`GET /u/[handle]/portrait` → 1080×1350 PNG (real aggregate or tagline fallback).
+
 ### `GET|POST /api/profiles/me`  (requireAuth)
 GET → `{ profile: { handle, published, created_at } | null }`.
 POST `{ handle, published }` → upsert own row (service role). Handle must