backend: per-user settings store (/api/settings) + enable account deletion

- user_settings table (userId PK -> user, jsonb preferences) + migration
- GET/PUT /api/settings (requireAuth, user-scoped; zod-validated flat map)
- Better Auth user.deleteUser enabled so users can delete their own account

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/lib/settings-validation.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+// Payload accepted by PUT /api/settings: a flat map of preference keys to
+// booleans or short strings. Capped so the JSONB column can't grow unbounded.
+export const settingsInputSchema = z.object({
+  preferences: z
+    .record(
+      z.string().min(1).max(64),
+      z.union([z.boolean(), z.string().max(500)]),
+    )
+    .refine((prefs) => Object.keys(prefs).length <= 100, {
+      message: "Too many preference keys.",
+    }),
+});
+
+export type SettingsInput = z.infer<typeof settingsInputSchema>;