Add the account area and account-synced Appearance preferences

Stage 1 PR 6 (ADR 0062). /account shows who is signed in; /account/appearance
chooses System, Light, or Dark and reduced motion (System, Reduce, Allow).

- Core: ekklesia_core_user_preference, one typed, CHECK-constrained,
  nullable column per preference (null = never chosen), migration
  0008_user_preferences (additive), @ekklesia/core/account store, and the
  authenticated-baseline permission core.account.self.manage.
- API: GET /api/v1/account (name, email, preferences) and partial
  PATCH /api/v1/account/preferences, self-only by construction: no user id
  is accepted anywhere; trusted Origin and body limit on the mutation.
- Shell: the account control shows name, email, and initials (never the
  unvetted image URL) and offers Account, Appearance, Sign out; native
  radio groups apply a choice at once through the ADR 0060 controller and
  save it; the server's answer wins and a failed save reverts.
- First paint: a classic, same-origin, render-blocking appearance.js in
  <head> applies a two-word localStorage cache before paint (no inline
  script, CSP unchanged). The account replaces the cache on every load,
  sign-out clears it, and other tabs follow via the storage event.
- Deploy smoke: real-Chromium checks for light/dark, OS emulation,
  overrides, reload persistence, pre-paint, Shadow DOM modules, reduced
  motion, the display staying light, and phone width; the browser
  container gets a 512 MiB /dev/shm so a long session no longer fails
  requests with ERR_INSUFFICIENT_RESOURCES.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/tests/dashboard-host-assets.test.ts

@@ -8,6 +8,7 @@ vi.mock("@ekklesia/shell/dashboard-assets", () => ({
   dashboardHostAssetUrls: Object.freeze({
     html: "file:///surface/browser/index.html",
     script: "file:///surface/browser/assets/ekklesia-dashboard/app.js",
+    appearance: "file:///surface/browser/assets/ekklesia-dashboard/appearance.js",
   }),
 }));
 
@@ -28,19 +29,26 @@ function sha256Etag(text: string): string {
 describe("Dashboard host asset loading", () => {
   beforeEach(() => readFileMock.mockReset());
 
-  it("reads only the two declared file URLs in order and freezes one consistent snapshot", async () => {
+  it("reads only the three declared file URLs in order and freezes one consistent snapshot", async () => {
     const html = `<!doctype html>${DASHBOARD_API_ORIGIN_PLACEHOLDER}<div id="ekklesia-host"></div>`;
     const script = "export const dashboardHost = true;\n";
-    readFileMock.mockResolvedValueOnce(html).mockResolvedValueOnce(script);
+    const appearanceScript = "(() => {})();\n";
+    readFileMock
+      .mockResolvedValueOnce(html)
+      .mockResolvedValueOnce(script)
+      .mockResolvedValueOnce(appearanceScript);
 
     const assets = await loadDashboardHostAssets(API_ORIGIN);
 
     expect(readFileMock.mock.calls).toEqual([
       [new URL("file:///surface/browser/index.html"), "utf8"],
       [new URL("file:///surface/browser/assets/ekklesia-dashboard/app.js"), "utf8"],
+      [new URL("file:///surface/browser/assets/ekklesia-dashboard/appearance.js"), "utf8"],
     ]);
     const rendered = `<!doctype html><meta content="${API_ORIGIN}" name="ekklesia-api-origin" /><div id="ekklesia-host"></div>`;
     expect(assets).toEqual({
+      appearanceScript,
+      appearanceScriptEtag: sha256Etag(appearanceScript),
       html: rendered,
       htmlEtag: sha256Etag(rendered),
       script,
@@ -83,12 +91,27 @@ describe("Dashboard host asset loading", () => {
     expect(readFileMock).toHaveBeenCalledTimes(2);
   });
 
-  it("rejects an empty page or script as an unavailable shell build", () => {
-    for (const [html, script] of [
-      ["", "export {};"],
-      ["<html></html>", "   \n"],
+  it("fails when the appearance script is missing even though the page and script were read", async () => {
+    readFileMock
+      .mockResolvedValueOnce(`<!doctype html>${DASHBOARD_API_ORIGIN_PLACEHOLDER}`)
+      .mockResolvedValueOnce("export {};\n")
+      .mockRejectedValueOnce(new Error("ENOENT appearance.js"));
+
+    await expect(loadDashboardHostAssets(API_ORIGIN)).rejects.toBeInstanceOf(
+      DashboardHostAssetError,
+    );
+    expect(readFileMock).toHaveBeenCalledTimes(3);
+  });
+
+  it("rejects an empty page, script, or appearance script as an unavailable shell build", () => {
+    for (const [html, script, appearance] of [
+      ["", "export {};", "(() => {})();"],
+      ["<html></html>", "   \n", "(() => {})();"],
+      ["<html></html>", "export {};", " "],
     ] as const) {
-      expect(() => createDashboardHostAssets(html, script)).toThrow(DashboardHostAssetError);
+      expect(() => createDashboardHostAssets(html, script, appearance)).toThrow(
+        DashboardHostAssetError,
+      );
     }
   });
 
@@ -99,7 +122,10 @@ describe("Dashboard host asset loading", () => {
       '<!doctype html><meta content="https://elsewhere.test" name="ekklesia-api-origin" />',
     ]) {
       readFileMock.mockReset();
-      readFileMock.mockResolvedValueOnce(html).mockResolvedValueOnce("export {};\n");
+      readFileMock
+        .mockResolvedValueOnce(html)
+        .mockResolvedValueOnce("export {};\n")
+        .mockResolvedValueOnce("(() => {})();\n");
       await expect(loadDashboardHostAssets(API_ORIGIN)).rejects.toBeInstanceOf(
         DashboardHostAssetError,
       );