Two tests, both driving /_create user with JSON - the path the apps actually
use, which no test covered before:
- keepActiveUser creates the profile while leaving the active user alone, and
the prepared contact can then be reassigned to it and connected.
- omitting keepActiveUser still parses and still activates. This is a
regression guard: iOS does not send the field, so if the record ever stopped
accepting its absence, profile creation there would break silently.