feat(api): expose and validate the audio resume rewind setting

GET/PUT /api/auth/profile now carries audio_resume_rewind_seconds
(always-present on the response: 0 is a real value, exact resume; the
request shape is the keep_screen_awake string precedent so the form
select can send an explicit 0=Off while JSON clients that omit it
leave the column untouched — a plain int with an omitempty contract
could not express 'set to off'). Strict allow-list {0,5,10}: the UI
offers exactly three choices and the API refuses everything else.

The audiobook chapters endpoint embeds resume_rewind_seconds in its
existing payload — it already loads the user row for playback speed,
so both players (web + Android, phone UI and the Android Auto service)
get the value with the fetch they perform anyway; zero extra round
trips.

Profile page gains the Resume Rewind select (Off / 5 s before /
10 s before) next to Default Playback Speed.

internal/handlers/auth.go

@@ -16,6 +16,7 @@ import (
 	"math"
 	"net/http"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -126,6 +127,10 @@ type UserProfile struct {
 	DefaultAudioSpeed float64 `json:"default_audio_speed,omitempty"`
 	// Whether the web reader/player should hold a Screen Wake Lock.
 	KeepScreenAwake bool `json:"keep_screen_awake"`
+	// Resume rewind: seconds before the saved position the audio
+	// player starts (open-resume and every genuine unpause). 0 is a
+	// real value (exact resume) — never omitted.
+	AudioResumeRewind int `json:"audio_resume_rewind_seconds"`
 }
 
 type ProfileUpdateRequest struct {
@@ -142,6 +147,11 @@ type ProfileUpdateRequest struct {
 	// Per the SPEEDS list bounds; the profile select always sends it,
 	// JSON clients omit it (0 = untouched).
 	DefaultAudioSpeed float64 `json:"default_audio_speed,omitempty" form:"default_audio_speed" validate:"omitempty,min=0.25,max=4"`
+	// Resume rewind seconds, as the form select sends it ("0"/"5"/"10").
+	// The string shape (keep_screen_awake precedent) lets the form
+	// select an explicit 0=Off while JSON clients that omit it decode
+	// as "" and leave the column untouched.
+	AudioResumeRewind string `json:"audio_resume_rewind_seconds,omitempty" form:"audio_resume_rewind_seconds" validate:"omitempty,oneof=0 5 10"`
 }
 
 // Register handles POST /api/auth/register
@@ -551,6 +561,7 @@ func (h *AuthHandler) GetProfile(c *echo.Context) error {
 		Theme:             user.Theme.String,
 		DefaultAudioSpeed: float64(user.DefaultAudioSpeed),
 		KeepScreenAwake:   user.KeepScreenAwake,
+		AudioResumeRewind: int(user.AudioResumeRewindSeconds),
 	})
 }
 
@@ -715,6 +726,24 @@ func (h *AuthHandler) UpdateProfile(c *echo.Context) error {
 		}
 	}
 
+	// Resume-rewind preference. The form select always sends it
+	// ("0"/"5"/"10"); JSON clients that omit it decode as "" and leave
+	// the column untouched. Strict allow-list — the three choices the
+	// UI offers are the only values the API accepts.
+	if req.AudioResumeRewind != "" {
+		rewind, err := strconv.Atoi(req.AudioResumeRewind)
+		if err != nil || (rewind != 0 && rewind != 5 && rewind != 10) {
+			return c.JSON(http.StatusBadRequest, map[string]string{"error": "audio_resume_rewind_seconds must be 0, 5, or 10"})
+		}
+		err = h.db.UpdateUserAudioResumeRewind(c.Request().Context(), database.UpdateUserAudioResumeRewindParams{
+			ID:                       targetUserUUID,
+			AudioResumeRewindSeconds: int32(rewind),
+		})
+		if err != nil {
+			return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		}
+	}
+
 	// Keep-screen-awake preference. The form dropdown always sends it
 	// ("true"/"false"); JSON clients that omit it decode as "" and leave
 	// the column untouched.