User accounts handle authentication, registration, etc. They are powered by Devise.
All of Devise's standard features are enabled by default, with the exception of Omniauth.
ShinyCMS extends Devise to allow site users to identity themselves with either a username or an email address during login (as standard, Devise will only accept an email address).
ShinyCMS also wraps Devise in its own feature flags code, allowing site admins with appropriate access to enable or disable the user logins and user registration features quickly and easily via either the CMS admin area on the website, or the feature flags rake task on the command-line.
User accounts may eventually be moved into a plugin (probably as a set of concerns and helpers that could be added to any site with Devise-powered authentication), but this isn't a high priority. The main app will remain necessary for some time just to handle user accounts, site settings, and feature flags.
User profile pages are handled by the ShinyProfiles plugin, not by the user account code in the main app, but separating these two sets of features is still a work in progress (the controllers and view templates are separate now, but the models and database tables are not).