feat(audio-player): per-book playback speed + user default (plan §8)

Speed becomes a per-USER-per-BOOK preference that syncs across
devices, with a user-level default for books not yet played:
- new audio_playback_speed table (mirrors reading_speed's shape; a
  preference, NOT a measurement and NOT a reading_progress column) +
  users.default_audio_speed, schema in place
- chapters endpoint resolves per-book row → user default → 1.0 and
  ships playback_speed + default_playback_speed (zero extra round
  trips; default powers the dropdown marker)
- PUT /api/media-items/:id/audio-speed upserts (range-checked; the
  client SPEEDS list stays the real gate; library visibility gates
  writes)
- the user default rides the profile path like theme/timezone:
  profile form gains a 'Default Playback Speed' select (server-side
  SpeedOptions mirrors the web SPEEDS list), GET /profile carries it
- web: restorePosition applies the resolved server speed (localStorage
  audio_speed demotes to a first-paint cache); setSpeed PUTs
  fire-and-forget with a failure toast; the Speed dropdown gains a
  '(default)' row marker and a 'Make N× my default' action with a
  success toast

ALSO fixes a pre-existing profile-page bug surfaced by the §8 form
verification: the password section's current_password input was
required INSIDE the shared form, so HTML5 validation blocked every
Save Changes submission (dead since the shell migration). The
password flow keeps its own gates (disabled-button checkers + server
400).

Integration test TestAudioPlaybackSpeed pins the full contract (unset
→ 1x, upsert resolution, range rejection, default fallback for
row-less books, default updates re-satisfying unset books). Verified
live: 9 Playwright checks.

internal/handlers/auth.go

@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"html/template"
+	"math"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -120,6 +121,8 @@ type UserProfile struct {
 	LastName  string `json:"last_name"`
 	Role      string `json:"role"`
 	Theme     string `json:"theme,omitempty"`
+	// User-level default audiobook playback speed (plan §8); 0 omits.
+	DefaultAudioSpeed float64 `json:"default_audio_speed,omitempty"`
 }
 
 type UpdateProfileRequest struct {
@@ -129,6 +132,9 @@ type UpdateProfileRequest struct {
 	LastName  string `json:"last_name,omitempty" form:"last_name" validate:"omitempty,max=100"`
 	Theme     string `json:"theme,omitempty" form:"theme" validate:"omitempty"`
 	Timezone  string `json:"timezone,omitempty" form:"timezone" validate:"omitempty"`
+	// Per the SPEEDS list bounds; the profile select always sends it,
+	// JSON clients omit it (0 = untouched).
+	DefaultAudioSpeed float64 `json:"default_audio_speed,omitempty" form:"default_audio_speed" validate:"omitempty,min=0.25,max=4"`
 }
 
 type AdminUpdateUserRequest struct {
@@ -139,6 +145,8 @@ type AdminUpdateUserRequest struct {
 	Theme     string `json:"theme,omitempty" form:"theme" validate:"omitempty"`
 	Timezone  string `json:"timezone,omitempty" form:"timezone" validate:"omitempty"`
 	Role      string `json:"role,omitempty" form:"role" validate:"omitempty,oneof=user admin"`
+	// Same semantics as UpdateProfileRequest.DefaultAudioSpeed.
+	DefaultAudioSpeed float64 `json:"default_audio_speed,omitempty" form:"default_audio_speed" validate:"omitempty,min=0.25,max=4"`
 }
 
 // Register handles POST /api/auth/register
@@ -538,13 +546,14 @@ func (h *AuthHandler) GetProfile(c *echo.Context) error {
 		lastName = user.LastName.String
 	}
 	return c.JSON(http.StatusOK, UserProfile{
-		ID:        uuid.UUID(user.ID.Bytes).String(),
-		Email:     user.Email,
-		Username:  user.Username,
-		FirstName: firstName,
-		LastName:  lastName,
-		Role:      user.Role,
-		Theme:     user.Theme.String,
+		ID:                uuid.UUID(user.ID.Bytes).String(),
+		Email:             user.Email,
+		Username:          user.Username,
+		FirstName:         firstName,
+		LastName:          lastName,
+		Role:              user.Role,
+		Theme:             user.Theme.String,
+		DefaultAudioSpeed: float64(user.DefaultAudioSpeed),
 	})
 }
 
@@ -693,6 +702,22 @@ func (h *AuthHandler) UpdateProfile(c *echo.Context) error {
 		}
 	}
 
+	// Update the default audiobook playback speed (plan §8). The form
+	// select always sends it; JSON clients that omit it decode as 0 and
+	// leave the column untouched.
+	if req.DefaultAudioSpeed != 0 {
+		if req.DefaultAudioSpeed < 0.25 || req.DefaultAudioSpeed > 4 || math.IsNaN(req.DefaultAudioSpeed) || math.IsInf(req.DefaultAudioSpeed, 0) {
+			return c.JSON(http.StatusBadRequest, map[string]string{"error": "default playback speed out of range"})
+		}
+		err := h.db.UpdateUserDefaultAudioSpeed(c.Request().Context(), database.UpdateUserDefaultAudioSpeedParams{
+			ID:                targetUserUUID,
+			DefaultAudioSpeed: float32(req.DefaultAudioSpeed),
+		})
+		if err != nil {
+			return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		}
+	}
+
 	// Browser path (htmx modal + profile page): refresh so every rendered
 	// value (timezone select, table rows, header) reflects the save and the
 	// modal closes. A bare JSON body swapped into #profile-result read as

internal/handlers/media.go

@@ -12,6 +12,7 @@ import (
 	"fmt"
 	"io"
 	"log"
+	"math"
 	"mime/multipart"
 	"net/http"
 	"net/url"
@@ -2990,16 +2991,96 @@ func (mh *MediaHandler) GetAudioChapters(c *echo.Context) error {
 		})
 	}
 
+	// Playback speed (plan §8): resolve per-book row → user default →
+	// 1.0 IN the payload so the player applies it with zero extra round
+	// trips; default_playback_speed powers the dropdown's "(default)"
+	// marker. Speed is a preference, so this rides the authenticated
+	// user — anonymous readers just get 1.0.
+	playbackSpeed, defaultSpeed := 1.0, 1.0
+	if userID, ok := c.Get("user_id").(string); ok {
+		if userUUID, err := uuid.Parse(userID); err == nil {
+			userRow, err := mh.db.GetUser(c.Request().Context(), pgtype.UUID{Bytes: userUUID, Valid: true})
+			if err == nil && userRow.DefaultAudioSpeed > 0 {
+				defaultSpeed = float64(userRow.DefaultAudioSpeed)
+			}
+			bookSpeed, err := mh.db.GetAudioPlaybackSpeed(c.Request().Context(), database.GetAudioPlaybackSpeedParams{
+				UserID:      pgtype.UUID{Bytes: userUUID, Valid: true},
+				MediaItemID: pgtype.UUID{Bytes: mediaUUID, Valid: true},
+			})
+			if err == nil && bookSpeed > 0 {
+				playbackSpeed = float64(bookSpeed)
+			} else {
+				playbackSpeed = defaultSpeed
+			}
+		}
+	}
+
 	return c.JSON(http.StatusOK, map[string]interface{}{
-		"media_item_id":    item.ID,
-		"chapters":         payload.Chapters,
-		"duration_seconds": payload.DurationSeconds,
-		"codec_profile":    payload.CodecProfile,
-		"layout":           payload.Layout,
-		"tracks":           tracks,
+		"media_item_id":          item.ID,
+		"chapters":               payload.Chapters,
+		"duration_seconds":       payload.DurationSeconds,
+		"codec_profile":          payload.CodecProfile,
+		"layout":                 payload.Layout,
+		"tracks":                 tracks,
+		"playback_speed":         playbackSpeed,
+		"default_playback_speed": defaultSpeed,
 	})
 }
 
+// SetAudioSpeed handles PUT /api/media-items/:id/audio-speed — the
+// per-user per-book playback speed upsert (plan §8). The client SPEEDS
+// list is the real gate; the server sanity-checks the range.
+func (mh *MediaHandler) SetAudioSpeed(c *echo.Context) error {	mediaID := c.Param("id")
+	mediaUUID, err := uuid.Parse(mediaID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid media item id"})
+	}
+	userID, ok := c.Get("user_id").(string)
+	if !ok || userID == "" {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+	}
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid user"})
+	}
+
+	var req struct {
+		Speed float64 `json:"speed"`
+	}
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	if req.Speed < 0.25 || req.Speed > 4 || math.IsNaN(req.Speed) || math.IsInf(req.Speed, 0) {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "speed out of range"})
+	}
+
+	// The book must exist (and be visible): a preference for a hidden
+	// library must not be writable — family-lens rule.
+	item, err := mh.db.GetMediaItem(c.Request().Context(), pgtype.UUID{Bytes: mediaUUID, Valid: true})
+	if err != nil {
+		return c.JSON(http.StatusNotFound, map[string]string{"error": "book not found"})
+	}
+	if item.LibraryID.Valid {
+		visibleSet, _, err := mh.visibleLibrarySet(c)
+		if err != nil {
+			return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to check library access"})
+		}
+		if !visibleSet[uuid.UUID(item.LibraryID.Bytes).String()] {
+			return c.JSON(http.StatusForbidden, map[string]string{"error": "library not accessible"})
+		}
+	}
+
+	speed, err := mh.db.UpsertAudioPlaybackSpeed(c.Request().Context(), database.UpsertAudioPlaybackSpeedParams{
+		UserID:      pgtype.UUID{Bytes: userUUID, Valid: true},
+		MediaItemID: pgtype.UUID{Bytes: mediaUUID, Valid: true},
+		Speed:       float32(req.Speed),
+	})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to save playback speed"})
+	}
+	return c.JSON(http.StatusOK, map[string]float64{"playback_speed": float64(speed)})
+}
+
 // GetAudioTrack handles GET /api/media-items/:id/audio/:trackIndex — the
 // per-track byte stream for multi-file audiobooks (folder books serve the
 // real file; zip books extract the entry in place). Library visibility is