feat(audio-player): per-book playback speed + user default (plan §8)

Speed becomes a per-USER-per-BOOK preference that syncs across
devices, with a user-level default for books not yet played:
- new audio_playback_speed table (mirrors reading_speed's shape; a
  preference, NOT a measurement and NOT a reading_progress column) +
  users.default_audio_speed, schema in place
- chapters endpoint resolves per-book row → user default → 1.0 and
  ships playback_speed + default_playback_speed (zero extra round
  trips; default powers the dropdown marker)
- PUT /api/media-items/:id/audio-speed upserts (range-checked; the
  client SPEEDS list stays the real gate; library visibility gates
  writes)
- the user default rides the profile path like theme/timezone:
  profile form gains a 'Default Playback Speed' select (server-side
  SpeedOptions mirrors the web SPEEDS list), GET /profile carries it
- web: restorePosition applies the resolved server speed (localStorage
  audio_speed demotes to a first-paint cache); setSpeed PUTs
  fire-and-forget with a failure toast; the Speed dropdown gains a
  '(default)' row marker and a 'Make N× my default' action with a
  success toast

ALSO fixes a pre-existing profile-page bug surfaced by the §8 form
verification: the password section's current_password input was
required INSIDE the shared form, so HTML5 validation blocked every
Save Changes submission (dead since the shell migration). The
password flow keeps its own gates (disabled-button checkers + server
400).

Integration test TestAudioPlaybackSpeed pins the full contract (unset
→ 1x, upsert resolution, range rejection, default fallback for
row-less books, default updates re-satisfying unset books). Verified
live: 9 Playwright checks.

internal/handlers/media.go

@@ -12,6 +12,7 @@ import (
 	"fmt"
 	"io"
 	"log"
+	"math"
 	"mime/multipart"
 	"net/http"
 	"net/url"
@@ -2990,16 +2991,96 @@ func (mh *MediaHandler) GetAudioChapters(c *echo.Context) error {
 		})
 	}
 
+	// Playback speed (plan §8): resolve per-book row → user default →
+	// 1.0 IN the payload so the player applies it with zero extra round
+	// trips; default_playback_speed powers the dropdown's "(default)"
+	// marker. Speed is a preference, so this rides the authenticated
+	// user — anonymous readers just get 1.0.
+	playbackSpeed, defaultSpeed := 1.0, 1.0
+	if userID, ok := c.Get("user_id").(string); ok {
+		if userUUID, err := uuid.Parse(userID); err == nil {
+			userRow, err := mh.db.GetUser(c.Request().Context(), pgtype.UUID{Bytes: userUUID, Valid: true})
+			if err == nil && userRow.DefaultAudioSpeed > 0 {
+				defaultSpeed = float64(userRow.DefaultAudioSpeed)
+			}
+			bookSpeed, err := mh.db.GetAudioPlaybackSpeed(c.Request().Context(), database.GetAudioPlaybackSpeedParams{
+				UserID:      pgtype.UUID{Bytes: userUUID, Valid: true},
+				MediaItemID: pgtype.UUID{Bytes: mediaUUID, Valid: true},
+			})
+			if err == nil && bookSpeed > 0 {
+				playbackSpeed = float64(bookSpeed)
+			} else {
+				playbackSpeed = defaultSpeed
+			}
+		}
+	}
+
 	return c.JSON(http.StatusOK, map[string]interface{}{
-		"media_item_id":    item.ID,
-		"chapters":         payload.Chapters,
-		"duration_seconds": payload.DurationSeconds,
-		"codec_profile":    payload.CodecProfile,
-		"layout":           payload.Layout,
-		"tracks":           tracks,
+		"media_item_id":          item.ID,
+		"chapters":               payload.Chapters,
+		"duration_seconds":       payload.DurationSeconds,
+		"codec_profile":          payload.CodecProfile,
+		"layout":                 payload.Layout,
+		"tracks":                 tracks,
+		"playback_speed":         playbackSpeed,
+		"default_playback_speed": defaultSpeed,
 	})
 }
 
+// SetAudioSpeed handles PUT /api/media-items/:id/audio-speed — the
+// per-user per-book playback speed upsert (plan §8). The client SPEEDS
+// list is the real gate; the server sanity-checks the range.
+func (mh *MediaHandler) SetAudioSpeed(c *echo.Context) error {	mediaID := c.Param("id")
+	mediaUUID, err := uuid.Parse(mediaID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid media item id"})
+	}
+	userID, ok := c.Get("user_id").(string)
+	if !ok || userID == "" {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+	}
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid user"})
+	}
+
+	var req struct {
+		Speed float64 `json:"speed"`
+	}
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	if req.Speed < 0.25 || req.Speed > 4 || math.IsNaN(req.Speed) || math.IsInf(req.Speed, 0) {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "speed out of range"})
+	}
+
+	// The book must exist (and be visible): a preference for a hidden
+	// library must not be writable — family-lens rule.
+	item, err := mh.db.GetMediaItem(c.Request().Context(), pgtype.UUID{Bytes: mediaUUID, Valid: true})
+	if err != nil {
+		return c.JSON(http.StatusNotFound, map[string]string{"error": "book not found"})
+	}
+	if item.LibraryID.Valid {
+		visibleSet, _, err := mh.visibleLibrarySet(c)
+		if err != nil {
+			return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to check library access"})
+		}
+		if !visibleSet[uuid.UUID(item.LibraryID.Bytes).String()] {
+			return c.JSON(http.StatusForbidden, map[string]string{"error": "library not accessible"})
+		}
+	}
+
+	speed, err := mh.db.UpsertAudioPlaybackSpeed(c.Request().Context(), database.UpsertAudioPlaybackSpeedParams{
+		UserID:      pgtype.UUID{Bytes: userUUID, Valid: true},
+		MediaItemID: pgtype.UUID{Bytes: mediaUUID, Valid: true},
+		Speed:       float32(req.Speed),
+	})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to save playback speed"})
+	}
+	return c.JSON(http.StatusOK, map[string]float64{"playback_speed": float64(speed)})
+}
+
 // GetAudioTrack handles GET /api/media-items/:id/audio/:trackIndex — the
 // per-track byte stream for multi-file audiobooks (folder books serve the
 // real file; zip books extract the entry in place). Library visibility is