feat: per-user dark mode

Opt-in dark mode under Settings > Appearance. The preference lives on the
user profile and applies app-wide on subsequent loads.

- Storage: dark_mode boolean not null default false on user_profiles,
  with 20260813_02_user_dark_mode.sql and a matching schema.sql line.
- API: PATCH /user/profile accepts a boolean darkMode; serialized
  profiles expose it.
- Frontend: UserProfileContext toggles the .dark class and color-scheme
  on the document root. Changes apply immediately while the save is in
  flight and roll back if it fails.
- Styling: the .dark palette covers the semantic app tokens plus the
  legacy hardcoded Tailwind neutrals (bg-white/*, gray text, borders,
  divides), so pages did not need forking one by one.

Rebased onto main. Two things had to be reconciled rather than merged:

main added quick_actions_visible, another optional profile column using
the same deploy-before-migrate fallback. The fallbacks are now per column
and cascade - a database that has quick_actions_visible but not yet
dark_mode keeps the former instead of dropping to the shared base select.

main's settings restructure dropped the sign-out control this branch's
import list still carried, so only the icons the page actually renders
are imported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>