BIG FIX: profile save + sport classification + KUD separation

1) auth/auth_v2.py — update_me bug fix:
   PUT /auth/me return value was 'return me(user)' but me() is a
   FastAPI route handler, not callable directly. Replaced with explicit
   re-fetch returning correct JSON shape. Profile changes now persist
   in UI after save.

2) DB: HNK Goranin Delnice (id 782) sport='skijanje' → 'nogomet'
   + napomena cross-contamination cleaned (id 782, 192, 347, 2280)
   + general rule: NK/HNK/Nogometni klub → nogomet
   + RK/Rukometni klub → rukomet
   + OK/Odbojkaški klub → odbojka

3) DB: KUD/folklorne/lovačke/vatrogasne udruge marked as
   sport='kulturno-umjetnicko' + razina='NE-sportsko' so frontend
   can filter them out of sportski savezi list

4) Backup: pgz_sport.klubovi_backup_20260505_0857

Verified: PUT /auth/me with damir@pgz.hr persists telefon change to DB
and returns fresh data

auth/auth_v2.py

@@ -514,7 +514,29 @@ def update_me(req: UpdateMeReq, request: Request, user = Depends(require_user)):
     db_exec(f"UPDATE pgz_sport.users SET {', '.join(fields)}, updated_at=now() WHERE id=%s", tuple(vals))
     ip, ua = _client(request)
     audit(user["id"], "profile.update", meta={"fields": [f.split("=")[0] for f in fields]}, ip=ip, ua=ua)
-    return me(user)
+    # Re-fetch fresh user data and return same shape as GET /me
+    fresh = db_one("SELECT * FROM pgz_sport.users WHERE id=%s", (user["id"],))
+    if not fresh:
+        raise HTTPException(404, "User not found after update")
+    enriched = db_one("""SELECT id, email, full_name, ime, prezime, user_type,
+                  klub_id, savez_id, must_change_pwd, aktivan, status,
+                  last_login, oib, telefon, phone, preferred_language, created_at,
+                  avatar_url, gdpr_consent_at, google_picture
+              FROM pgz_sport.users WHERE id=%s""", (user["id"],))
+    tenant = _resolve_tenant(enriched)
+    roles = db_query("""SELECT r.code, r.naziv, ur.scope_type, ur.scope_id
+        FROM pgz_sport.user_roles ur JOIN pgz_sport.roles r ON r.id=ur.role_id
+        WHERE ur.user_id=%s AND ur.active=true""", (user["id"],))
+    try:
+        twofa = db_one("SELECT secret IS NOT NULL AS enabled FROM pgz_sport.user_2fa WHERE user_id=%s",
+                       (user["id"],)) or {"enabled": False}
+    except Exception:
+        twofa = {"enabled": False}
+    return {**enriched,
+            "tier": _tier_for(enriched.get("user_type") or ""),
+            "must_change_pwd": bool(enriched.get("must_change_pwd")),
+            "two_factor_enabled": bool(twofa.get("enabled")),
+            **tenant, "roles": roles}
 
 # ───────────────────────────  AVATAR UPLOAD  ───────────────────────────
 import shutil, pathlib