feat(api): expose and validate the audio resume rewind setting

GET/PUT /api/auth/profile now carries audio_resume_rewind_seconds
(always-present on the response: 0 is a real value, exact resume; the
request shape is the keep_screen_awake string precedent so the form
select can send an explicit 0=Off while JSON clients that omit it
leave the column untouched — a plain int with an omitempty contract
could not express 'set to off'). Strict allow-list {0,5,10}: the UI
offers exactly three choices and the API refuses everything else.

The audiobook chapters endpoint embeds resume_rewind_seconds in its
existing payload — it already loads the user row for playback speed,
so both players (web + Android, phone UI and the Android Auto service)
get the value with the fetch they perform anyway; zero extra round
trips.

Profile page gains the Resume Rewind select (Off / 5 s before /
10 s before) next to Default Playback Speed.

templates/types.go

@@ -20,6 +20,9 @@ type User struct {
 	// User-level default audiobook playback speed (plan §8); 0 means
 	// "unset" and renders as the 1× option.
 	DefaultAudioSpeed float64
+	// Resume rewind: seconds before the saved position the audio
+	// player starts (0 = exact resume; allow-list 0/5/10).
+	AudioResumeRewind int
 	// Whether the web reader/player should hold a Screen Wake Lock.
 	KeepScreenAwake bool
 	// Sidebar /podcasts entry gate (plan D13): the user can see >=1