Merge branch 'main' into dark-mode

Resolves a semantic conflict in backend/src/routes/user.ts, where main
rebuilt selectProfile's deploy-before-migrate cascade (adding the
20260821 onboarding/password tiers and threading cascadeError between
them) while this branch added its own dark_mode tier to the old shape.

Composed both rather than taking either side:

- PROFILE_SELECT is main's full column list plus dark_mode, appended
  last so an older database still fails the full select on one of the
  earlier 20260821 columns and lands on the right tier.
- PROFILE_SELECT_NO_DARK_MODE is exactly that list minus dark_mode, so
  a database missing only dark_mode keeps its live onboarding,
  password and quick-action columns instead of dropping a tier.
- The dark_mode retry sits above main's tiers (newest column first) and
  threads cascadeError the way they do.

main's password/onboarding tiers return rows without dark_mode, which
is safe: serializeProfile reads it as `row.dark_mode === true`, so an
absent column serializes to false.

Verified on Node 22 to match CI: backend build + 746 tests pass;
frontend 561 tests pass with branches at 97.61% (floor 97), lint 0
errors, production build succeeds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>