Add the account area and account-synced Appearance preferences

Stage 1 PR 6 (ADR 0062). /account shows who is signed in; /account/appearance
chooses System, Light, or Dark and reduced motion (System, Reduce, Allow).

- Core: ekklesia_core_user_preference, one typed, CHECK-constrained,
  nullable column per preference (null = never chosen), migration
  0008_user_preferences (additive), @ekklesia/core/account store, and the
  authenticated-baseline permission core.account.self.manage.
- API: GET /api/v1/account (name, email, preferences) and partial
  PATCH /api/v1/account/preferences, self-only by construction: no user id
  is accepted anywhere; trusted Origin and body limit on the mutation.
- Shell: the account control shows name, email, and initials (never the
  unvetted image URL) and offers Account, Appearance, Sign out; native
  radio groups apply a choice at once through the ADR 0060 controller and
  save it; the server's answer wins and a failed save reverts.
- First paint: a classic, same-origin, render-blocking appearance.js in
  <head> applies a two-word localStorage cache before paint (no inline
  script, CSP unchanged). The account replaces the cache on every load,
  sign-out clears it, and other tabs follow via the storage event.
- Deploy smoke: real-Chromium checks for light/dark, OS emulation,
  overrides, reload persistence, pre-paint, Shadow DOM modules, reduced
  motion, the display staying light, and phone width; the browser
  container gets a 512 MiB /dev/shm so a long session no longer fails
  requests with ERR_INSUFFICIENT_RESOURCES.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/dashboard-assets.test.ts

@@ -8,9 +8,13 @@ import { dashboardHostAssetUrls } from "../src/dashboard-assets.js";
 const packageDirectory = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 
 describe("Dashboard host asset locator", () => {
-  it("exports only frozen immutable href strings for the two exact built files, never the source map", () => {
+  it("exports only frozen immutable href strings for the three exact built files, never the source map", () => {
     expect(Object.isFrozen(dashboardHostAssetUrls)).toBe(true);
     expect(dashboardHostAssetUrls).toEqual({
+      appearance: new URL(
+        "dist/browser/assets/ekklesia-dashboard/appearance.js",
+        `file://${packageDirectory}/`,
+      ).href,
       html: new URL("dist/browser/index.html", `file://${packageDirectory}/`).href,
       script: new URL(
         "dist/browser/assets/ekklesia-dashboard/app.js",
@@ -43,14 +47,28 @@ describe("Dashboard host asset locator", () => {
     expect(html).toContain("color: var(--ekklesia-text-primary);");
   });
 
-  it("loads exactly one fixed, absolute, same-origin script and no inline script", async () => {
+  it("loads exactly two fixed, absolute, same-origin scripts and no inline script", async () => {
     const html = await readFile(path.join(packageDirectory, "index.html"), "utf8");
 
     expect(html).toContain('id="ekklesia-host"');
-    expect(html.match(/<script\b/gu)).toHaveLength(1);
+    expect(html.match(/<script\b/gu)).toHaveLength(2);
     expect(html).toContain(
       '<script src="/assets/ekklesia-dashboard/app.js" type="module"></script>',
     );
+    expect(html).toContain('<script src="/assets/ekklesia-dashboard/appearance.js"></script>');
+    // Every script names a source: there is no inline script for a strict script-src to excuse.
+    expect(html.match(/<script(?![^>]*\bsrc=")/gu)).toBeNull();
+  });
+
+  it("applies the cached appearance before first paint: a classic script in <head>, after the colour-scheme element it narrows (ADR 0062)", async () => {
+    const html = await readFile(path.join(packageDirectory, "index.html"), "utf8");
+    const head = html.slice(html.indexOf("<head>"), html.indexOf("</head>"));
+    const boot = head.indexOf('<script src="/assets/ekklesia-dashboard/appearance.js"></script>');
+
+    // Classic (no `type="module"`, no `defer`, no `async`), so it blocks rendering until it ran.
+    expect(boot).toBeGreaterThan(-1);
+    expect(head.indexOf('name="color-scheme"')).toBeLessThan(boot);
+    expect(head.slice(boot)).not.toMatch(/appearance\.js"[^>]*(?:type=|defer|async)/u);
   });
 
   it("carries exactly one empty API-origin meta element for the serving API to fill (ADR 0045)", async () => {
@@ -76,5 +94,6 @@ describe("Dashboard host asset locator", () => {
     );
 
     expect(buildScript).toContain('"assets/ekklesia-dashboard/app": path.join(');
+    expect(buildScript).toContain('"assets/ekklesia-dashboard/appearance": path.join(');
   });
 });