Stage 17: cap display-name special characters at 5 (ui + backend)

display_name validation gains a rule: at most 5 special characters — the '.' / '_'
punctuation (spaces, which separate words, don't count) — so a still-well-formed name
can't be mostly punctuation. Mirrored in the Go ValidateDisplayName and the UI
validDisplayName; both unit-tested (5 ok, 6 rejected, 'J. R. R. Tolkien' ok). Docs:
FUNCTIONAL (+ _ru).

ui/src/lib/profileValidation.test.ts

@@ -19,6 +19,9 @@ describe('validDisplayName', () => {
     ['Name2', false],
     ['', false],
     ['a'.repeat(33), false],
+    ['a.a.a.a.a.a', true], // 5 dots — at the special-char limit
+    ['a.a.a.a.a.a.a', false], // 6 dots — over the limit
+    ['J. R. R. Tolkien', true], // 3 dots; spaces are not special
   ])('%s -> %s', (name, ok) => {
     expect(validDisplayName(name)).toBe(ok);
   });