Per-user browse preferences

Adds a preferences JSON field on the user plus GET/POST
/api/auth/preferences/ (merge semantics, validated keys), surfaced in
/auth/me/ and typed on the frontend.

The Account page gains a Browsing preferences card: landing page,
default rating filter, default sort, items per page and thumbnail size.
Signed-in users also sync these while browsing (the Library sidebar's
rating/sort/per-page controls and the new thumbnail slider), debounced;
on load the account's values seed the local UI state, so settings follow
the user across browsers. Guests keep the existing localStorage
behaviour. The thumbnail size drives the media grids (Library, Online,
pool detail) between 140 and 320px columns.

Verified the API against the dev server: merge keeps untouched keys,
invalid values 400, values round-trip through /auth/me/.

backend/apps/accounts/views.py

@@ -10,6 +10,7 @@ from apps.library.models import MediaItem
 from .models import User
 from .serializers import (
     E621CredentialsSerializer,
+    PreferencesSerializer,
     RegisterSerializer,
     UserListSerializer,
     UserSerializer,
@@ -137,6 +138,24 @@ class AvatarView(APIView):
         return Response(UserSerializer(user, context={"request": request}).data)
 
 
+class PreferencesView(APIView):
+    """Per-user browse preferences, merged so callers can send single keys."""
+
+    permission_classes = [IsAuthenticated]
+
+    def get(self, request):
+        return Response(request.user.preferences or {})
+
+    def post(self, request):
+        serializer = PreferencesSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        preferences = dict(request.user.preferences or {})
+        preferences.update(serializer.validated_data)
+        request.user.preferences = preferences
+        request.user.save(update_fields=["preferences"])
+        return Response(preferences)
+
+
 class UserViewSet(
     mixins.ListModelMixin,
     mixins.RetrieveModelMixin,