Add the account area and account-synced Appearance preferences

Stage 1 PR 6 (ADR 0062). /account shows who is signed in; /account/appearance
chooses System, Light, or Dark and reduced motion (System, Reduce, Allow).

- Core: ekklesia_core_user_preference, one typed, CHECK-constrained,
  nullable column per preference (null = never chosen), migration
  0008_user_preferences (additive), @ekklesia/core/account store, and the
  authenticated-baseline permission core.account.self.manage.
- API: GET /api/v1/account (name, email, preferences) and partial
  PATCH /api/v1/account/preferences, self-only by construction: no user id
  is accepted anywhere; trusted Origin and body limit on the mutation.
- Shell: the account control shows name, email, and initials (never the
  unvetted image URL) and offers Account, Appearance, Sign out; native
  radio groups apply a choice at once through the ADR 0060 controller and
  save it; the server's answer wins and a failed save reverts.
- First paint: a classic, same-origin, render-blocking appearance.js in
  <head> applies a two-word localStorage cache before paint (no inline
  script, CSP unchanged). The account replaces the cache on every load,
  sign-out clears it, and other tabs follow via the storage event.
- Deploy smoke: real-Chromium checks for light/dark, OS emulation,
  overrides, reload persistence, pre-paint, Shadow DOM modules, reduced
  motion, the display staying light, and phone width; the browser
  container gets a 512 MiB /dev/shm so a long session no longer fails
  requests with ERR_INSUFFICIENT_RESOURCES.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/scripts/build-browser.mjs

@@ -67,6 +67,27 @@ const buildOptions = {
   target: "es2022",
 };
 
+/**
+ * The Dashboard's pre-paint appearance script (ADR 0062): a **classic** script, not a module,
+ * because only a classic script in `<head>` runs before the body is parsed and painted. Built
+ * separately as an IIFE, with nothing shared with the main bundle at run time, so it stays a few
+ * hundred bytes and adds no import to a render-blocking request.
+ */
+/** @type {import("esbuild").BuildOptions} */
+const appearanceBootOptions = {
+  ...buildOptions,
+  entryPoints: {
+    "assets/ekklesia-dashboard/appearance": path.join(
+      packageDirectory,
+      "src",
+      "browser",
+      "appearance-boot.ts",
+    ),
+  },
+  format: "iife",
+  sourcemap: false,
+};
+
 await rm(outputDirectory, { force: true, recursive: true });
 await mkdir(outputDirectory, { recursive: true });
 await mkdir(path.join(outputDirectory, "display"), { recursive: true });
@@ -87,6 +108,8 @@ await copyFile(
 );
 
 if (serve) {
+  const appearanceBootContext = await esbuild.context(appearanceBootOptions);
+  await appearanceBootContext.watch();
   const context = await esbuild.context(buildOptions);
   await context.watch();
   // Any path with no file behind it gets the Dashboard page, so a refreshed deep link such as
@@ -104,5 +127,6 @@ if (serve) {
   );
 } else {
   await esbuild.build(buildOptions);
+  await esbuild.build(appearanceBootOptions);
   console.log(`Built the Ekklesia shell into ${path.relative(packageDirectory, outputDirectory)}`);
 }