feat(profile): keep_screen_awake user preference (default on)

New users column surfaced as an On/Off dropdown in the profile form.
The form and API carry "true"/"false" strings with the theme-style
""-guard, so JSON clients that omit the field can't clobber it;
anything else is rejected. GET/PUT /api/auth/profile expose
keep_screen_awake alongside the other profile fields, and the reader
route threads the preference into its template metadata.

Integration tests pin the schema default, both values, omission
semantics, and rejection — dedicated test user, never testuser.

internal/handlers/auth.go

@@ -122,6 +122,8 @@ type UserProfile struct {
 	Theme     string `json:"theme,omitempty"`
 	// User-level default audiobook playback speed (plan §8); 0 omits.
 	DefaultAudioSpeed float64 `json:"default_audio_speed,omitempty"`
+	// Whether the web reader/player should hold a Screen Wake Lock.
+	KeepScreenAwake bool `json:"keep_screen_awake"`
 }
 
 type ProfileUpdateRequest struct {
@@ -132,6 +134,9 @@ type ProfileUpdateRequest struct {
 	Theme     string `json:"theme,omitempty" form:"theme" validate:"omitempty"`
 	Timezone  string `json:"timezone,omitempty" form:"timezone" validate:"omitempty"`
 	Role      string `json:"role,omitempty" form:"role" validate:"omitempty,oneof=user admin"`
+	// "true"/"false" — the profile dropdown always sends it; JSON clients
+	// that omit it decode as "" and leave the column untouched.
+	KeepScreenAwake string `json:"keep_screen_awake,omitempty" form:"keep_screen_awake" validate:"omitempty,oneof=true false"`
 	// Per the SPEEDS list bounds; the profile select always sends it,
 	// JSON clients omit it (0 = untouched).
 	DefaultAudioSpeed float64 `json:"default_audio_speed,omitempty" form:"default_audio_speed" validate:"omitempty,min=0.25,max=4"`
@@ -542,6 +547,7 @@ func (h *AuthHandler) GetProfile(c *echo.Context) error {
 		Role:              user.Role,
 		Theme:             user.Theme.String,
 		DefaultAudioSpeed: float64(user.DefaultAudioSpeed),
+		KeepScreenAwake:   user.KeepScreenAwake,
 	})
 }
 
@@ -706,6 +712,22 @@ func (h *AuthHandler) UpdateProfile(c *echo.Context) error {
 		}
 	}
 
+	// Keep-screen-awake preference. The form dropdown always sends it
+	// ("true"/"false"); JSON clients that omit it decode as "" and leave
+	// the column untouched.
+	if req.KeepScreenAwake != "" {
+		if req.KeepScreenAwake != "true" && req.KeepScreenAwake != "false" {
+			return c.JSON(http.StatusBadRequest, map[string]string{"error": "keep_screen_awake must be 'true' or 'false'"})
+		}
+		err := h.db.UpdateUserKeepScreenAwake(c.Request().Context(), database.UpdateUserKeepScreenAwakeParams{
+			ID:              targetUserUUID,
+			KeepScreenAwake: req.KeepScreenAwake == "true",
+		})
+		if err != nil {
+			return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		}
+	}
+
 	// Browser path (htmx modal + profile page): refresh so every rendered
 	// value (timezone select, table rows, header) reflects the save and the
 	// modal closes. A bare JSON body swapped into #profile-result read as