Let each role, and each person, choose where they land after signing in

A role now has a start page: the dashboard, files, upload, groups,
clients or the activity log (the last two for staff only). Anyone can
override their role's choice in their profile. The administrator role
takes a start page too, while everything else about it stays locked.

A choice is only used if the account can open that page now. Otherwise
the next one down is tried, ending at the dashboard, so a permission
removed later never lands somebody on a 403. A role cannot be saved
with a start page its own permissions block. A link followed before
signing in still wins, and a waiting getting-started or what's-new page
still goes first.

Applies to password, two-factor and provider sign-ins, and to the site
root for someone already signed in. StartPageTest opens every page for
real, with and without its permission, so the enum cannot drift from
the routes.

Requested by @Zodiac1978 in #1777.

app/Http/Controllers/Settings/ProfileController.php

@@ -10,6 +10,8 @@ use App\Modules\Clients\ClientFieldContext;
 use App\Modules\Clients\ClientPortalCustomFields;
 use App\Modules\Identity\Erasure\ErasureSchedule;
 use App\Modules\Identity\StaffAccounts;
+use App\Modules\Identity\StartPage;
+use App\Modules\Identity\StartPages;
 use App\Modules\Platform\Localization\TimezoneRegistry;
 use App\Modules\Platform\Settings\Setting;
 use App\Modules\Platform\Settings\Settings;
@@ -26,6 +28,7 @@ class ProfileController extends Controller
         private readonly ClientPortalCustomFields $customFields,
         private readonly TimezoneRegistry $timezones,
         private readonly StaffAccounts $accounts,
+        private readonly StartPages $startPages,
     ) {}
 
     /**
@@ -44,6 +47,12 @@ class ProfileController extends Controller
             // browser was detected as, not something they ever chose.
             'timezone' => $this->timezones->resolve($user),
             'timezones' => $this->timezones->options(),
+            // Stored, not resolved: an empty choice means "follow my role",
+            // and the form has to be able to say that rather than show the
+            // role's page as if the person had picked it.
+            'start_page' => $user->start_page,
+            'start_page_options' => $this->startPages->personalOptions($user),
+            'role_start_page' => (string) __(($this->startPages->roleDefault($user) ?? StartPage::Dashboard)->label($user->type)),
             'custom_fields' => $user->isClient() ? $this->customFields->rows(ClientFieldContext::AccountEdit, $user) : [],
             'custom_field_values' => $user->isClient() ? $this->customFields->values(ClientFieldContext::AccountEdit, $user) : [],
         ]);