fix: secure adult visibility and telegram bot access

web/src/api/play_profiles.ts

@@ -38,6 +38,6 @@ export const playProfilesAPI = {
       .post<PlayProfilePINVerifyResponse>(`/play-profiles/${id}/verify-pin`, { pin })
       .then((r) => r.data),
 
-  remove: (id: string) =>
-    api.delete(`/play-profiles/${id}`).then((r) => r.data),
+  remove: (id: string, proof?: { pin?: string; password?: string }) =>
+    api.delete(`/play-profiles/${id}`, { data: proof ?? {} }).then((r) => r.data),
 }

web/src/api/profile.ts

@@ -2,7 +2,14 @@ import { api } from './client'
 import type { User } from '../types'
 
 export const profileAPI = {
-  update: (patch: { email?: string; avatar_url?: string }) =>
+  update: (patch: {
+    username?: string
+    nickname?: string
+    email?: string
+    avatar_url?: string
+    hide_adult?: boolean
+    password?: string
+  }) =>
     api.patch<User>('/me', patch).then((r) => r.data),
 
   adminUpdateRole: (id: string, role: 'admin' | 'user') =>