feat(audio-player): per-book playback speed + user default (plan §8)

Speed becomes a per-USER-per-BOOK preference that syncs across
devices, with a user-level default for books not yet played:
- new audio_playback_speed table (mirrors reading_speed's shape; a
  preference, NOT a measurement and NOT a reading_progress column) +
  users.default_audio_speed, schema in place
- chapters endpoint resolves per-book row → user default → 1.0 and
  ships playback_speed + default_playback_speed (zero extra round
  trips; default powers the dropdown marker)
- PUT /api/media-items/:id/audio-speed upserts (range-checked; the
  client SPEEDS list stays the real gate; library visibility gates
  writes)
- the user default rides the profile path like theme/timezone:
  profile form gains a 'Default Playback Speed' select (server-side
  SpeedOptions mirrors the web SPEEDS list), GET /profile carries it
- web: restorePosition applies the resolved server speed (localStorage
  audio_speed demotes to a first-paint cache); setSpeed PUTs
  fire-and-forget with a failure toast; the Speed dropdown gains a
  '(default)' row marker and a 'Make N× my default' action with a
  success toast

ALSO fixes a pre-existing profile-page bug surfaced by the §8 form
verification: the password section's current_password input was
required INSIDE the shared form, so HTML5 validation blocked every
Save Changes submission (dead since the shell migration). The
password flow keeps its own gates (disabled-button checkers + server
400).

Integration test TestAudioPlaybackSpeed pins the full contract (unset
→ 1x, upsert resolution, range rejection, default fallback for
row-less books, default updates re-satisfying unset books). Verified
live: 9 Playwright checks.

internal/database/models.go

@@ -8,6 +8,15 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type AudioPlaybackSpeed struct {
+	ID          pgtype.UUID        `db:"id" json:"id"`
+	UserID      pgtype.UUID        `db:"user_id" json:"user_id"`
+	MediaItemID pgtype.UUID        `db:"media_item_id" json:"media_item_id"`
+	Speed       float32            `db:"speed" json:"speed"`
+	CreatedAt   pgtype.Timestamptz `db:"created_at" json:"created_at"`
+	UpdatedAt   pgtype.Timestamptz `db:"updated_at" json:"updated_at"`
+}
+
 type CollectionItems struct {
 	ID            pgtype.UUID        `db:"id" json:"id"`
 	CollectionID  pgtype.UUID        `db:"collection_id" json:"collection_id"`
@@ -575,16 +584,17 @@ type UserDashboardPreferencesGlobal struct {
 }
 
 type Users struct {
-	ID           pgtype.UUID        `db:"id" json:"id"`
-	Email        string             `db:"email" json:"email"`
-	Username     string             `db:"username" json:"username"`
-	PasswordHash string             `db:"password_hash" json:"password_hash"`
-	FirstName    pgtype.Text        `db:"first_name" json:"first_name"`
-	LastName     pgtype.Text        `db:"last_name" json:"last_name"`
-	Role         string             `db:"role" json:"role"`
-	Theme        pgtype.Text        `db:"theme" json:"theme"`
-	MaxDevices   pgtype.Int4        `db:"max_devices" json:"max_devices"`
-	CreatedAt    pgtype.Timestamptz `db:"created_at" json:"created_at"`
-	Timezone     pgtype.Text        `db:"timezone" json:"timezone"`
-	UpdatedAt    pgtype.Timestamptz `db:"updated_at" json:"updated_at"`
+	ID                pgtype.UUID        `db:"id" json:"id"`
+	Email             string             `db:"email" json:"email"`
+	Username          string             `db:"username" json:"username"`
+	PasswordHash      string             `db:"password_hash" json:"password_hash"`
+	FirstName         pgtype.Text        `db:"first_name" json:"first_name"`
+	LastName          pgtype.Text        `db:"last_name" json:"last_name"`
+	Role              string             `db:"role" json:"role"`
+	Theme             pgtype.Text        `db:"theme" json:"theme"`
+	MaxDevices        pgtype.Int4        `db:"max_devices" json:"max_devices"`
+	CreatedAt         pgtype.Timestamptz `db:"created_at" json:"created_at"`
+	Timezone          pgtype.Text        `db:"timezone" json:"timezone"`
+	UpdatedAt         pgtype.Timestamptz `db:"updated_at" json:"updated_at"`
+	DefaultAudioSpeed float32            `db:"default_audio_speed" json:"default_audio_speed"`
 }