fix(profile): stop falling back to email when display_name is empty

The owner attribution helper used to fall back from display_name to
the part of the email before "@" when no display name was set. That
defeats the point of letting users pick a name: anyone who hadn't
explicitly chosen one had their email prefix surfaced publicly.

New fallback chain, applied uniformly:
  - display_name (the user's chosen name) — if set, use it
  - username (also chosen by the user as a URL slug) — if set, use it
  - null — render nothing; the client hides the attribution line

Wire type ActivityPublic.owner_display is now `string | null`.
ActivityRow renders the "Lagt til av X" line only when display is
non-null.

Same idea applied to the user's own surfaces (nav + greeting):
  - Nav button shows "Profil" (a label, not a name) when display_name
    is empty, instead of falling back to the email.
  - Home greeting drops "Velkommen, <name>." entirely when the user
    has no display name, leaving just "Her er aktivitetene dine ...".

The feedback list (moderator view) and admin user table keep showing
the email — moderators and admins legitimately need it to identify
users for triage and role management.

shared/types.ts

@@ -173,7 +173,13 @@ export interface ActivityPublic {
   id: string;
   visibility: 'public';
   owner_id: string;             // serialized for public
-  owner_display: string;        // display_name OR derived handle (email prefix)
+  /**
+   * Public-facing handle: display_name OR (when only the slug is set) the
+   * username. NULL when the owner has set neither — in that case the client
+   * hides attribution entirely rather than falling back to the email or to
+   * an identifier the user didn't choose.
+   */
+  owner_display: string | null;
   // Owner's URL slug, if they've opted into a public list. When non-null, the
   // client renders the owner attribution as a link to /<owner_username>/list.
   owner_username: string | null;