Add the account area and account-synced Appearance preferences

Stage 1 PR 6 (ADR 0062). /account shows who is signed in; /account/appearance
chooses System, Light, or Dark and reduced motion (System, Reduce, Allow).

- Core: ekklesia_core_user_preference, one typed, CHECK-constrained,
  nullable column per preference (null = never chosen), migration
  0008_user_preferences (additive), @ekklesia/core/account store, and the
  authenticated-baseline permission core.account.self.manage.
- API: GET /api/v1/account (name, email, preferences) and partial
  PATCH /api/v1/account/preferences, self-only by construction: no user id
  is accepted anywhere; trusted Origin and body limit on the mutation.
- Shell: the account control shows name, email, and initials (never the
  unvetted image URL) and offers Account, Appearance, Sign out; native
  radio groups apply a choice at once through the ADR 0060 controller and
  save it; the server's answer wins and a failed save reverts.
- First paint: a classic, same-origin, render-blocking appearance.js in
  <head> applies a two-word localStorage cache before paint (no inline
  script, CSP unchanged). The account replaces the cache on every load,
  sign-out clears it, and other tabs follow via the storage event.
- Deploy smoke: real-Chromium checks for light/dark, OS emulation,
  overrides, reload persistence, pre-paint, Shadow DOM modules, reduced
  motion, the display staying light, and phone width; the browser
  container gets a 512 MiB /dev/shm so a long session no longer fails
  requests with ERR_INSUFFICIENT_RESOURCES.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

core/tests/identity-verification-boundaries.test.ts

@@ -170,12 +170,14 @@ describe("the browser shell reaches none of it", () => {
 
   it("never puts a reset token in browser storage", async () => {
     // A reset token is a bearer credential for one account; the shell holds it in React state for
-    // the life of one form and nowhere else. The shell's one use of browser storage is the desktop
-    // sidebar's expanded/collapsed mode (ADR 0058), so that use is pinned exactly: `localStorage` is
-    // named only by the entry point, and only to hand it to the sidebar preference, whose one write
-    // is its own fixed key and a validated mode.
+    // the life of one form and nowhere else. The shell's uses of browser storage are pinned
+    // exactly: the desktop sidebar's expanded/collapsed mode (ADR 0058) and the pre-paint copy of
+    // the person's appearance (ADR 0062). `localStorage` is named only by the entry point, once, to
+    // hand to those two, and by the pre-paint script, once, to read its one key. Each write is its
+    // own fixed key and a validated value.
     const files = await readTypeScriptFiles(path.join("surfaces", "shell", "src"));
     const writes: string[] = [];
+    const removals: string[] = [];
     for (const file of files) {
       const code = withoutComments(file.text);
       expect(code, file.path).not.toContain("sessionStorage");
@@ -185,18 +187,32 @@ describe("the browser shell reaches none of it", () => {
           (match) => `${path.relative(repositoryRoot, file.path)}: ${match[1]}`,
         ),
       );
+      removals.push(
+        ...[...code.matchAll(/\.removeItem\(([^)]*)\)/gu)].map(
+          (match) => `${path.relative(repositoryRoot, file.path)}: ${match[1]}`,
+        ),
+      );
       if (file.path.endsWith(path.join("browser", "main.tsx"))) {
         expect(code.match(/localStorage/gu), file.path).toHaveLength(1);
         expect(code).toMatch(
-          /createLocalSidebarPreference\(\s*\(\(\) => \{\s*try \{\s*return window\.localStorage;/u,
+          /const browserStorage = \(\(\) => \{\s*try \{\s*return window\.localStorage;/u,
         );
+        expect(code).toContain("createLocalSidebarPreference(browserStorage)");
+        expect(code).toContain("createLocalAppearanceCache(browserStorage)");
+      } else if (file.path.endsWith(path.join("browser", "appearance-boot.ts"))) {
+        expect(code.match(/localStorage/gu), file.path).toHaveLength(1);
+        expect(code).toContain("window.localStorage.getItem(APPEARANCE_CACHE_KEY)");
       } else {
         expect(code, file.path).not.toContain("localStorage");
       }
     }
     expect(writes).toEqual([
+      `${path.join("surfaces", "shell", "src", "browser", "appearance-cache.ts")}: APPEARANCE_CACHE_KEY, serialized`,
       `${path.join("surfaces", "shell", "src", "browser", "sidebar-preference.ts")}: SIDEBAR_PREFERENCE_KEY, mode`,
     ]);
+    expect(removals).toEqual([
+      `${path.join("surfaces", "shell", "src", "browser", "appearance-cache.ts")}: APPEARANCE_CACHE_KEY`,
+    ]);
     // The files that ever hold the token touch no storage API at all.
     for (const file of files.filter((candidate) =>
       ["auth-protocol.ts", "ResetPasswordForm.tsx", "HostApp.tsx"].some((name) =>