feat: add user settings page

[prissca]

Summary

Adds a secure /settings page (redirects to sign-in if unauthenticated) for managing display name, avatar, and notification preferences.

• app/[locale]/settings/page.jsx — server component gating access behind getCurrentUser(), rendering SettingsForm with the current user's public profile data.
• components/settings-form.jsx — client form (useFormState/useFormStatus) with a client-side avatar preview (FileReader, type/size-validated: images only, up to 1MB), display-name input, and email/in-app notification toggles. Email itself is read-only with an explanatory note, since changing it needs separate verification.
• app/[locale]/actions/auth.js — updateSettings server action, gated on an authenticated session, validating input via a new zod SettingsSchema (display name length, avatar as a data: URL or a real URL, boolean notification flags) before persisting to the user record and revalidating the layout.
• app/api/auth/me/route.js — GET endpoint returning the current session's public user (or 401), used by notification-context.jsx for client-side session/preference checks.
• profile/page.jsx and auth-status.jsx updated to reflect the new settings surface and the (now real, not placeholder) notification preferences.

Closes #86

Test plan

• Could not run npm run build/tests locally — node_modules here is incomplete (missing @next/bundle-analyzer and no local next binary), unrelated to this change; please run npm i && npm run build
• Manually visit /settings while signed out and confirm redirect to sign-in with a next param back to settings
• Manually update display name, avatar, and notification toggles, save, and confirm changes persist and are reflected on the profile page and in notification behavior