STUBBED: functional placeholder — full legacy parity pending. The profile, password-change and 2FA endpoints are live at /api/customer/profile, /api/customer/password/change and /api/customer/2fa/*; this page ports the minimal profile + password forms.