feat: add user preferences dashboard

- Add /preferences route and preferences.html template for user settings
- Implement username, email, password, and theme update functionality
- Add account deletion feature with confirmation
- Add navigation link to preferences from dashboard
- Create API endpoints:
  - PUT /api/user/username - Update username
  - PUT /api/user/email - Update email address
  - PUT /api/user/password - Change password with verification
  - DELETE /api/user/account - Delete user account
- Add database queries for user updates and account deletion
- Create Bruno API testing files for all user preference endpoints
- Add proper validation, error handling, and security checks

bruno/user/Delete Account.bru

@@ -0,0 +1,39 @@
+meta {
+  name: Delete Account
+  type: http
+  seq: 4
+}
+
+delete {
+  url: {{base_url}}/api/user/account
+  body: none
+  auth: inherit
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Delete Account
+
+  Permanently deletes the authenticated user's account and all associated data.
+
+  **Method:** DELETE
+
+  **Endpoint:** /api/user/account
+
+  **Authentication:** Required
+
+  **Request Body:** None
+
+  **Response:**
+  - `message` (string): Success message
+
+  **Status Codes:**
+  - 200: Success
+  - 401: Unauthorized
+
+  **Warning:** This action cannot be undone and will permanently delete all user data including ebooks, ratings, and progress.
+}

bruno/user/Update Email.bru

@@ -0,0 +1,46 @@
+meta {
+  name: Update Email
+  type: http
+  seq: 2
+}
+
+put {
+  url: {{base_url}}/api/user/email
+  body: json
+  auth: inherit
+}
+
+body {
+  {
+    "email": "newemail@example.com"
+  }
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Update Email
+
+  Updates the authenticated user's email address.
+
+  **Method:** PUT
+
+  **Endpoint:** /api/user/email
+
+  **Authentication:** Required
+
+  **Request Body:**
+  - `email` (string, required): New email address (must be valid email format)
+
+  **Response:**
+  - `message` (string): Success message
+
+  **Status Codes:**
+  - 200: Success
+  - 400: Invalid email format
+  - 401: Unauthorized
+  - 409: Email already taken
+}

bruno/user/Update Password.bru

@@ -0,0 +1,50 @@
+meta {
+  name: Update Password
+  type: http
+  seq: 3
+}
+
+put {
+  url: {{base_url}}/api/user/password
+  body: json
+  auth: inherit
+}
+
+body {
+  {
+    "current_password": "currentpassword",
+    "new_password": "newpassword123",
+    "confirm_password": "newpassword123"
+  }
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Update Password
+
+  Updates the authenticated user's password.
+
+  **Method:** PUT
+
+  **Endpoint:** /api/user/password
+
+  **Authentication:** Required
+
+  **Request Body:**
+  - `current_password` (string, required): Current password for verification
+  - `new_password` (string, required): New password (minimum 6 characters)
+  - `confirm_password` (string, required): Confirmation of new password
+
+  **Response:**
+  - `message` (string): Success message
+
+  **Status Codes:**
+  - 200: Success
+  - 400: Password validation failed
+  - 401: Current password incorrect
+  - 401: Unauthorized
+}

bruno/user/Update Username.bru

@@ -0,0 +1,46 @@
+meta {
+  name: Update Username
+  type: http
+  seq: 1
+}
+
+put {
+  url: {{base_url}}/api/user/username
+  body: json
+  auth: inherit
+}
+
+body {
+  {
+    "username": "newusername"
+  }
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Update Username
+
+  Updates the authenticated user's username.
+
+  **Method:** PUT
+
+  **Endpoint:** /api/user/username
+
+  **Authentication:** Required
+
+  **Request Body:**
+  - `username` (string, required): New username (3-50 characters)
+
+  **Response:**
+  - `message` (string): Success message
+
+  **Status Codes:**
+  - 200: Success
+  - 400: Invalid username
+  - 401: Unauthorized
+  - 409: Username already taken
+}