Add the account area and account-synced Appearance preferences

Stage 1 PR 6 (ADR 0062). /account shows who is signed in; /account/appearance
chooses System, Light, or Dark and reduced motion (System, Reduce, Allow).

- Core: ekklesia_core_user_preference, one typed, CHECK-constrained,
  nullable column per preference (null = never chosen), migration
  0008_user_preferences (additive), @ekklesia/core/account store, and the
  authenticated-baseline permission core.account.self.manage.
- API: GET /api/v1/account (name, email, preferences) and partial
  PATCH /api/v1/account/preferences, self-only by construction: no user id
  is accepted anywhere; trusted Origin and body limit on the mutation.
- Shell: the account control shows name, email, and initials (never the
  unvetted image URL) and offers Account, Appearance, Sign out; native
  radio groups apply a choice at once through the ADR 0060 controller and
  save it; the server's answer wins and a failed save reverts.
- First paint: a classic, same-origin, render-blocking appearance.js in
  <head> applies a two-word localStorage cache before paint (no inline
  script, CSP unchanged). The account replaces the cache on every load,
  sign-out clears it, and other tabs follow via the storage event.
- Deploy smoke: real-Chromium checks for light/dark, OS emulation,
  overrides, reload persistence, pre-paint, Shadow DOM modules, reduced
  motion, the display staying light, and phone width; the browser
  container gets a 512 MiB /dev/shm so a long session no longer fails
  requests with ERR_INSUFFICIENT_RESOURCES.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/lib/deploy-smoke-client.mjs

@@ -73,8 +73,9 @@ async function edgeChecks() {
   check(
     page.headers.get("content-type") === "text/html; charset=utf-8" &&
       html.includes('id="ekklesia-host"') &&
-      html.includes('src="/assets/ekklesia-dashboard/app.js"'),
-    "GET / is the Dashboard HTML",
+      html.includes('src="/assets/ekklesia-dashboard/app.js"') &&
+      html.includes('<script src="/assets/ekklesia-dashboard/appearance.js"></script>'),
+    "GET / is the Dashboard HTML, with its pre-paint appearance script (ADR 0062)",
   );
   check(
     page.headers.get("x-frame-options") === "DENY" &&
@@ -90,7 +91,12 @@ async function edgeChecks() {
 
   // Every Dashboard page answers with that same page, so a refresh stays put (ADR 0057). No module
   // is installed yet at this point; a module's own address is reloaded in a real browser later.
-  for (const deepLink of ["/settings", "/settings/displays/add", "/account"]) {
+  for (const deepLink of [
+    "/settings",
+    "/settings/displays/add",
+    "/account",
+    "/account/appearance",
+  ]) {
     const deepPage = await fetch(`${dashboardOrigin}${deepLink}`);
     check(
       deepPage.status === 200 &&
@@ -113,6 +119,17 @@ async function edgeChecks() {
   await script.arrayBuffer();
   check(script.status === 200, "GET /assets/ekklesia-dashboard/app.js is 200");
 
+  const appearanceScript = await fetch(
+    `${dashboardOrigin}/assets/ekklesia-dashboard/appearance.js`,
+  );
+  const appearanceSource = await appearanceScript.text();
+  check(
+    appearanceScript.status === 200 &&
+      appearanceScript.headers.get("content-type") === "text/javascript; charset=utf-8" &&
+      appearanceSource.includes("ekklesia.dashboard.appearance"),
+    "GET /assets/ekklesia-dashboard/appearance.js is the pre-paint script",
+  );
+
   const outside = await fetch(`${dashboardOrigin}/favicon.ico`);
   check(
     outside.status === 404 && !(outside.headers.get("content-type") ?? "").includes("json"),
@@ -181,6 +198,10 @@ async function splitRoutingChecks() {
     await refusedByProxy(`${apiOrigin}/assets/ekklesia-dashboard/app.js`),
     "the API hostname refuses the Dashboard's script",
   );
+  check(
+    await refusedByProxy(`${apiOrigin}/assets/ekklesia-dashboard/appearance.js`),
+    "the API hostname refuses the Dashboard's pre-paint script",
+  );
   const display = await fetch(`${apiOrigin}/display/does-not-exist`);
   check(
     display.status === 404 && (await display.text()) === '{"code":"NOT_FOUND"}',
@@ -460,6 +481,38 @@ async function sessionChecks() {
     "the session resolves an authenticated principal through the proxy",
   );
 
+  // The person's own account (ADR 0062): who they are, and a preference that round-trips.
+  const account = await fetch(`${apiOrigin}/api/v1/account`, {
+    headers: { cookie, origin: dashboardOrigin },
+  });
+  const accountBody = await account.json();
+  check(
+    account.status === 200 &&
+      accountBody.email === required("SMOKE_OWNER_EMAIL") &&
+      Object.keys(accountBody).sort().join(",") === "email,name,preferences",
+    "GET /api/v1/account returns the signed-in person's own name, email, and preferences only",
+  );
+  const changePreferences = async (body) => {
+    const response = await fetch(`${apiOrigin}/api/v1/account/preferences`, {
+      body: JSON.stringify(body),
+      headers: { "content-type": "application/json", cookie, origin: dashboardOrigin },
+      method: "PATCH",
+    });
+    return { body: await response.json(), status: response.status };
+  };
+  const saved = await changePreferences({ motion: "reduce" });
+  check(
+    saved.status === 200 && saved.body.motion === "reduce",
+    "PATCH /api/v1/account/preferences saves a change to the person's own account",
+  );
+  const restored = await changePreferences(accountBody.preferences);
+  check(restored.status === 200, "the account's previous preferences are put back");
+  const anonymousAccount = await fetch(`${apiOrigin}/api/v1/account`, {
+    headers: { origin: dashboardOrigin },
+  });
+  await anonymousAccount.arrayBuffer();
+  check(anonymousAccount.status === 403, "an anonymous caller is refused the account");
+
   const signOut = await fetch(`${apiOrigin}/api/auth/sign-out`, {
     body: "{}",
     headers: { "content-type": "application/json", cookie, origin: dashboardOrigin },