Fix data race on shared title-case transformer in profile updates

golang.org/x/text/cases.Caser is not safe for concurrent use, but UpdateProfileHandler shared one package-level instance. A fresh caser is now created per call via titleCase().

backend/handlers/user/profile.go

@@ -40,7 +40,14 @@ func getEnv(key, fallback string) string {
 	return fallback
 }
 
-var titleCaser = cases.Title(language.English)
+// titleCase converts a name to Title Case. A fresh cases.Caser is created per
+// call because golang.org/x/text/cases.Caser is NOT safe for concurrent use
+// (it is a stateful transformer), and UpdateProfileHandler may run for two
+// users at once. The package-level var previously shared one instance, which
+// the race detector flagged (DATA RACE on titleCaser.String).
+func titleCase(s string) string {
+	return cases.Title(language.English).String(strings.ToLower(s))
+}
 
 type UserProfile struct {
 	ID                string  `json:"id"`
@@ -297,8 +304,8 @@ func UpdateProfileHandler(w http.ResponseWriter, r *http.Request) {
 	req.Phone = strings.TrimSpace(phone)
 
 	// Title case names
-	req.FirstName = titleCaser.String(strings.ToLower(req.FirstName))
-	req.LastName = titleCaser.String(strings.ToLower(req.LastName))
+	req.FirstName = titleCase(req.FirstName)
+	req.LastName = titleCase(req.LastName)
 
 	// Fetch user's current data for name change detection and CardDAV update
 	var email string