Update the authenticated account username (the email cannot be changed through the API)

The API never changes the email. A different address is refused with 403 email_change_requires_web when the username is unchanged, and ignored when the username changes in the same request. Email changes happen only in Account settings on the website, and a new address starts unverified. Surrounding whitespace is trimmed and the address is lowercased before it is validated, checked against other accounts regardless of case, and stored.

Surrounding whitespace is trimmed; a value that is empty after trimming fails with validation_error, message "Invalid account profile fields" and details.fields including "username". Sending the account's current username keeps it unchanged, even if it predates the username rule. A new username must be 3-50 characters matching ^[A-Za-z0-9._-]+$, include a letter or a number, and not look like an account ID, or the request fails with validation_error, the rule's message and details.field "username". A new username that another account holds in any letter case, or that equals another account's ID, fails the same way with "This username is already taken".