The frontend boot endpoint.

GET always responds 200, regardless of authentication and site privacy: user is null for anonymous callers, and the rest of the payload is limited to privacy-safe configuration the frontend always needs (to render login screens, privacy interstitials, forms, and navigation). It also sets the CSRF cookie, so a fresh browser session can make authenticated POSTs after calling this.

PATCH updates the current user's profile and returns the same payload.