Per-user browse preferences

Adds a preferences JSON field on the user plus GET/POST
/api/auth/preferences/ (merge semantics, validated keys), surfaced in
/auth/me/ and typed on the frontend.

The Account page gains a Browsing preferences card: landing page,
default rating filter, default sort, items per page and thumbnail size.
Signed-in users also sync these while browsing (the Library sidebar's
rating/sort/per-page controls and the new thumbnail slider), debounced;
on load the account's values seed the local UI state, so settings follow
the user across browsers. Guests keep the existing localStorage
behaviour. The thumbnail size drives the media grids (Library, Online,
pool detail) between 140 and 320px columns.

Verified the API against the dev server: merge keeps untouched keys,
invalid values 400, values round-trip through /auth/me/.

ROADMAP.md

@@ -135,7 +135,8 @@ Files now stage first and are resolved before entering the library.
       (Library/Online/Similar) and long pool descriptions
 - [x] Profile pictures: staff Users page and a self-service Account picker
       (searchable library grid, remove supported) set avatars from library J-IDs
-- [ ] Profile extras (per-user browse preferences)
+- [x] Profile extras: per-user landing page, default rating filter/sort, items
+      per page and thumbnail size (synced to the account, applied on load)
 - [x] Command palette: tag finder, recent searches, navigation commands
       (Ctrl+K / ⌘K, reachable from anywhere in the shell)