feat: per-user dark mode

Opt-in dark mode under Settings > Appearance. The preference lives on the
user profile and applies app-wide on subsequent loads.

- Storage: dark_mode boolean not null default false on user_profiles,
  with 20260813_02_user_dark_mode.sql and a matching schema.sql line.
- API: PATCH /user/profile accepts a boolean darkMode; serialized
  profiles expose it.
- Frontend: UserProfileContext toggles the .dark class and color-scheme
  on the document root. Changes apply immediately while the save is in
  flight and roll back if it fails.
- Styling: the .dark palette covers the semantic app tokens plus the
  legacy hardcoded Tailwind neutrals (bg-white/*, gray text, borders,
  divides), so pages did not need forking one by one.

Rebased onto main. Two things had to be reconciled rather than merged:

main added quick_actions_visible, another optional profile column using
the same deploy-before-migrate fallback. The fallbacks are now per column
and cascade - a database that has quick_actions_visible but not yet
dark_mode keeps the former instead of dropping to the shared base select.

main's settings restructure dropped the sign-out control this branch's
import list still carried, so only the icons the page actually renders
are imported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

theme.ts is inside the coverage-gated src/app/lib/** include set, but
its two existing tests both run under jsdom, where `document` is always
defined. The `typeof document === "undefined"` early return was never
taken, leaving theme.ts at 75% branches and pulling the lib layer's
global branch coverage to 96.91% - just under the 97% ratchet floor.

Stub `document` away for a third case so both arms of the guard are
exercised. theme.ts is now 100% across all four metrics and the global
branch figure is back to 97.15%.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Resolves a semantic conflict in backend/src/routes/user.ts, where main
rebuilt selectProfile's deploy-before-migrate cascade (adding the
20260821 onboarding/password tiers and threading cascadeError between
them) while this branch added its own dark_mode tier to the old shape.

Composed both rather than taking either side:

- PROFILE_SELECT is main's full column list plus dark_mode, appended
  last so an older database still fails the full select on one of the
  earlier 20260821 columns and lands on the right tier.
- PROFILE_SELECT_NO_DARK_MODE is exactly that list minus dark_mode, so
  a database missing only dark_mode keeps its live onboarding,
  password and quick-action columns instead of dropping a tier.
- The dark_mode retry sits above main's tiers (newest column first) and
  threads cascadeError the way they do.

main's password/onboarding tiers return rows without dark_mode, which
is safe: serializeProfile reads it as `row.dark_mode === true`, so an
absent column serializes to false.

Verified on Node 22 to match CI: backend build + 746 tests pass;
frontend 561 tests pass with branches at 97.61% (floor 97), lint 0
errors, production build succeeds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>