Phase 2: custom-instructions panel on the account page

Adds a Custom Instructions section to /account that fetches and saves
via the new PIP /me endpoints. The section explains that user-level
instructions are additive on top of the organisation's instructions
and may not override them, and includes the AI-output disclaimer.

  - Loads the current custom_instructions from GET /me.
  - Saves with PATCH /me. Live character counter against the 4096 cap.
  - Shows a Discard button when dirty, a Saved indicator on success,
    and a red counter when the textarea exceeds the cap.

The existing display name, organisation, plan, sign-out, and delete-
account sections on the same page continue to use the upstream
Supabase-backed paths; they will be migrated when those backend routes
move off the Supabase JS client onto plain pg.

End-to-end round trip verified against Postgres 16:
  - GET /me returns the existing instructions.
  - PATCH /me persists a new value.
  - 5000-character payload is server-side truncated to 4096.