Add the account area and account-synced Appearance preferences

Stage 1 PR 6 (ADR 0062). /account shows who is signed in; /account/appearance
chooses System, Light, or Dark and reduced motion (System, Reduce, Allow).

- Core: ekklesia_core_user_preference, one typed, CHECK-constrained,
  nullable column per preference (null = never chosen), migration
  0008_user_preferences (additive), @ekklesia/core/account store, and the
  authenticated-baseline permission core.account.self.manage.
- API: GET /api/v1/account (name, email, preferences) and partial
  PATCH /api/v1/account/preferences, self-only by construction: no user id
  is accepted anywhere; trusted Origin and body limit on the mutation.
- Shell: the account control shows name, email, and initials (never the
  unvetted image URL) and offers Account, Appearance, Sign out; native
  radio groups apply a choice at once through the ADR 0060 controller and
  save it; the server's answer wins and a failed save reverts.
- First paint: a classic, same-origin, render-blocking appearance.js in
  <head> applies a two-word localStorage cache before paint (no inline
  script, CSP unchanged). The account replaces the cache on every load,
  sign-out clears it, and other tabs follow via the storage event.
- Deploy smoke: real-Chromium checks for light/dark, OS emulation,
  overrides, reload persistence, pre-paint, Shadow DOM modules, reduced
  motion, the display staying light, and phone width; the browser
  container gets a 512 MiB /dev/shm so a long session no longer fails
  requests with ERR_INSUFFICIENT_RESOURCES.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/tests/support/dashboard-host-assets.ts

@@ -9,5 +9,6 @@ export function testDashboardHostAssets(): DashboardHostAssets {
   return createDashboardHostAssets(
     '<!doctype html><div id="ekklesia-host"></div><script src="/assets/ekklesia-dashboard/app.js" type="module"></script>',
     "export const dashboardHost = true;\n",
+    "(() => {})();\n",
   );
 }

apps/api/tests/support/in-memory-account-store.ts

@@ -0,0 +1,85 @@
+import type { EkklesiaUserId } from "@ekklesia/contracts";
+import {
+  type AccountPreferences,
+  type AccountPreferencesUpdate,
+  type AccountStore,
+  AccountStoreError,
+  type AccountSummary,
+  DEFAULT_ACCOUNT_PREFERENCES,
+  parseAccountPreferencesUpdate,
+} from "@ekklesia/core/account";
+
+export interface InMemoryAccountPerson {
+  readonly userId: string;
+  readonly name: string;
+  readonly email: string;
+  readonly preferences?: Partial<AccountPreferences>;
+}
+
+export interface InMemoryAccountStore extends AccountStore {
+  /** Every user id a read or write was asked for, in order, so a route test can prove which account
+   * the route touched — the session's, and never one named by the request. */
+  readonly requestedUserIds: readonly string[];
+  /** Makes the next operations fail the way an unreachable database would. */
+  failWith(code: "ACCOUNT_READ_FAILED" | "ACCOUNT_WRITE_FAILED" | undefined): void;
+}
+
+/**
+ * An in-memory `AccountStore` for tests that exercise **routing and authorization**, not
+ * persistence. It reproduces the store's contract — strict update parsing, partial updates, an
+ * unknown person is not found — and nothing a database owns; persistence, the `CHECK`
+ * constraints, isolation across connections, and the cascade are proven against real PostgreSQL in
+ * `core/tests/account-store.integration.ts`.
+ */
+export function createInMemoryAccountStore(
+  people: readonly InMemoryAccountPerson[] = [],
+): InMemoryAccountStore {
+  const records = new Map<string, { name: string; email: string; preferences: AccountPreferences }>(
+    people.map((person) => [
+      person.userId,
+      {
+        email: person.email,
+        name: person.name,
+        preferences: { ...DEFAULT_ACCOUNT_PREFERENCES, ...person.preferences },
+      },
+    ]),
+  );
+  const requestedUserIds: string[] = [];
+  let failure: "ACCOUNT_READ_FAILED" | "ACCOUNT_WRITE_FAILED" | undefined;
+
+  return {
+    failWith(code) {
+      failure = code;
+    },
+    async readAccount(userId: EkklesiaUserId): Promise<AccountSummary | undefined> {
+      requestedUserIds.push(userId);
+      if (failure) {
+        throw new AccountStoreError("ACCOUNT_READ_FAILED");
+      }
+      const record = records.get(userId);
+      return record
+        ? { email: record.email, name: record.name, preferences: { ...record.preferences } }
+        : undefined;
+    },
+    requestedUserIds,
+    async updatePreferences(
+      userId: EkklesiaUserId,
+      update: AccountPreferencesUpdate,
+    ): Promise<AccountPreferences> {
+      requestedUserIds.push(userId);
+      const parsed = parseAccountPreferencesUpdate(update);
+      if (!parsed) {
+        throw new AccountStoreError("ACCOUNT_PREFERENCES_INVALID");
+      }
+      if (failure) {
+        throw new AccountStoreError("ACCOUNT_WRITE_FAILED");
+      }
+      const record = records.get(userId);
+      if (!record) {
+        throw new AccountStoreError("ACCOUNT_NOT_FOUND");
+      }
+      record.preferences = { ...record.preferences, ...parsed };
+      return { ...record.preferences };
+    },
+  };
+}