Add the account area and account-synced Appearance preferences

Stage 1 PR 6 (ADR 0062). /account shows who is signed in; /account/appearance
chooses System, Light, or Dark and reduced motion (System, Reduce, Allow).

- Core: ekklesia_core_user_preference, one typed, CHECK-constrained,
  nullable column per preference (null = never chosen), migration
  0008_user_preferences (additive), @ekklesia/core/account store, and the
  authenticated-baseline permission core.account.self.manage.
- API: GET /api/v1/account (name, email, preferences) and partial
  PATCH /api/v1/account/preferences, self-only by construction: no user id
  is accepted anywhere; trusted Origin and body limit on the mutation.
- Shell: the account control shows name, email, and initials (never the
  unvetted image URL) and offers Account, Appearance, Sign out; native
  radio groups apply a choice at once through the ADR 0060 controller and
  save it; the server's answer wins and a failed save reverts.
- First paint: a classic, same-origin, render-blocking appearance.js in
  <head> applies a two-word localStorage cache before paint (no inline
  script, CSP unchanged). The account replaces the cache on every load,
  sign-out clears it, and other tabs follow via the storage event.
- Deploy smoke: real-Chromium checks for light/dark, OS emulation,
  overrides, reload persistence, pre-paint, Shadow DOM modules, reduced
  motion, the display staying light, and phone width; the browser
  container gets a 512 MiB /dev/shm so a long session no longer fails
  requests with ERR_INSUFFICIENT_RESOURCES.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/host-protocol.test.ts

@@ -4,11 +4,15 @@ import {
   type HostModuleUiDescriptor,
   HostProtocolError,
   loadDashboardNavigation,
+  loadHostAccount,
   loadHostPrincipal,
   parseDashboardNavigation,
   parseDashboardSettings,
+  parseHostAccount,
+  parseHostAccountPreferences,
   parseHostPrincipal,
   resolveApiOrigin,
+  saveHostAccountPreferences,
 } from "../src/host-protocol.js";
 import { createModuleUiContext, moduleUiSourceUrl } from "../src/module-context.js";
 
@@ -37,6 +41,12 @@ function stubFetch(routes: Readonly<Record<string, () => Response>>) {
   return { calls, implementation: implementation as unknown as typeof fetch };
 }
 
+const accountPayload = {
+  email: "[email protected]",
+  name: "Ada Lovelace",
+  preferences: { appearance: "dark", motion: "reduce" },
+};
+
 const inventoryPayload = {
   modules: [
     {
@@ -304,6 +314,7 @@ describe("host protocol — bootstrap", () => {
           sections: ["displays"],
         }),
       "/api/v1/principal": () => jsonResponse({ kind: "authenticated", userId: "user-1" }),
+      "/api/v1/account": () => jsonResponse(accountPayload),
     });
 
     const bootstrap = await bootstrapHost({ apiBaseUrl, fetch: implementation });
@@ -312,7 +323,9 @@ describe("host protocol — bootstrap", () => {
       `${apiBaseUrl}/api/v1/principal`,
       `${apiBaseUrl}/api/v1/dashboard/navigation`,
       `${apiBaseUrl}/api/v1/dashboard/settings`,
+      `${apiBaseUrl}/api/v1/account`,
     ]);
+    expect(bootstrap.account).toEqual(accountPayload);
     expect(bootstrap.principal).toEqual({ kind: "authenticated", userId: "user-1" });
     expect(bootstrap.navigation.groups[0]?.modules[0]?.descriptor).toEqual(exampleDescriptor);
     expect(bootstrap.settings).toEqual({
@@ -571,3 +584,106 @@ describe("module UI host context", () => {
     );
   });
 });
+
+describe("host protocol — the signed-in person's account (ADR 0062)", () => {
+  it("reads the account strictly: exactly name, email, and two known preferences", () => {
+    expect(parseHostAccount(accountPayload)).toEqual(accountPayload);
+    for (const payload of [
+      null,
+      {},
+      { ...accountPayload, image: "https://tracker.example.test/me.png" },
+      { ...accountPayload, userId: "user-1" },
+      { ...accountPayload, email: "" },
+      { ...accountPayload, email: 1 },
+      { ...accountPayload, name: null },
+      { ...accountPayload, preferences: { appearance: "sepia", motion: "reduce" } },
+      { ...accountPayload, preferences: { appearance: "dark", motion: "none" } },
+      { ...accountPayload, preferences: { appearance: "dark" } },
+      { ...accountPayload, preferences: { appearance: "dark", motion: "allow", radius: "lg" } },
+    ]) {
+      expect(() => parseHostAccount(payload), JSON.stringify(payload)).toThrowError(
+        expect.objectContaining({ code: "HOST_RESPONSE_INVALID" }),
+      );
+    }
+  });
+
+  it.each([
+    ["system", "system"],
+    ["light", "reduce"],
+    ["dark", "allow"],
+  ] as const)("accepts appearance %s with motion %s", (appearance, motion) => {
+    expect(parseHostAccountPreferences({ appearance, motion })).toEqual({ appearance, motion });
+  });
+
+  it("loads the account from its one platform path, with credentials, naming nobody", async () => {
+    const { calls, implementation } = stubFetch({
+      "/api/v1/account": () => jsonResponse(accountPayload),
+    });
+
+    expect(await loadHostAccount({ apiBaseUrl, fetch: implementation })).toEqual(accountPayload);
+    expect(calls).toHaveLength(1);
+    expect(calls[0]?.url).toBe(`${apiBaseUrl}/api/v1/account`);
+    expect(calls[0]?.init?.credentials).toBe("include");
+  });
+
+  it("saves a change with one credentialed PATCH of exactly the change, and returns the server's answer", async () => {
+    const { calls, implementation } = stubFetch({
+      "/api/v1/account/preferences": () => jsonResponse({ appearance: "light", motion: "reduce" }),
+    });
+
+    const saved = await saveHostAccountPreferences(
+      { apiBaseUrl, fetch: implementation },
+      { appearance: "light" },
+    );
+
+    expect(saved).toEqual({ appearance: "light", motion: "reduce" });
+    expect(calls).toHaveLength(1);
+    expect(calls[0]?.url).toBe(`${apiBaseUrl}/api/v1/account/preferences`);
+    expect(calls[0]?.init?.method).toBe("PATCH");
+    expect(calls[0]?.init?.credentials).toBe("include");
+    expect(calls[0]?.init?.redirect).toBe("error");
+    expect(JSON.parse(String(calls[0]?.init?.body))).toEqual({ appearance: "light" });
+  });
+
+  it("reports a refused save as signed out, and a failed one as unreachable", async () => {
+    for (const [status, code] of [
+      [403, "HOST_UNAUTHENTICATED"],
+      [503, "HOST_REQUEST_FAILED"],
+      [400, "HOST_REQUEST_FAILED"],
+    ] as const) {
+      const { implementation } = stubFetch({
+        "/api/v1/account/preferences": () => jsonResponse({ code: "X" }, status),
+      });
+      await expect(
+        saveHostAccountPreferences({ apiBaseUrl, fetch: implementation }, { motion: "allow" }),
+      ).rejects.toMatchObject({ code });
+    }
+  });
+
+  it("keeps the Dashboard working when the account cannot be loaded", async () => {
+    const consoleError = vi.spyOn(console, "error").mockImplementation(() => undefined);
+    const { implementation } = stubFetch({
+      "/api/v1/account": () => jsonResponse({ code: "ACCOUNT_READ_FAILED" }, 503),
+      "/api/v1/dashboard/navigation": () => jsonResponse(navigationPayload),
+      "/api/v1/dashboard/settings": () => jsonResponse({ modules: [], sections: [] }),
+      "/api/v1/principal": () => jsonResponse({ kind: "authenticated", userId: "user-1" }),
+    });
+
+    const bootstrap = await bootstrapHost({ apiBaseUrl, fetch: implementation });
+
+    expect(bootstrap.account).toBe("unavailable");
+    expect(bootstrap.navigation.groups[0]?.modules[0]?.descriptor).toEqual(exampleDescriptor);
+    consoleError.mockRestore();
+  });
+
+  it("never asks for an account on behalf of an anonymous viewer", async () => {
+    const { calls, implementation } = stubFetch({
+      "/api/v1/principal": () => jsonResponse({ kind: "anonymous" }),
+    });
+
+    const bootstrap = await bootstrapHost({ apiBaseUrl, fetch: implementation });
+
+    expect(bootstrap.account).toBe("unavailable");
+    expect(calls.map((call) => call.url)).toEqual([`${apiBaseUrl}/api/v1/principal`]);
+  });
+});