backend: per-user settings store (/api/settings) + enable account deletion

- user_settings table (userId PK -> user, jsonb preferences) + migration
- GET/PUT /api/settings (requireAuth, user-scoped; zod-validated flat map)
- Better Auth user.deleteUser enabled so users can delete their own account

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/auth.ts

@@ -43,6 +43,14 @@ export const auth = betterAuth({
     },
   },
 
+  user: {
+    // Lets a signed-in user delete their own account from Settings. The
+    // frontend confirms with the user's password (authClient.deleteUser).
+    deleteUser: {
+      enabled: true,
+    },
+  },
+
   emailVerification: {
     sendOnSignUp: true,
     autoSignInAfterVerification: true,