feat(quick-261016-0fm): per-admin theme and locale preferences

- GET and PUT /account/preferences (own row only, interactive sessions,
  CSRF header on cookie writes) store admin_theme and admin_locale in
  backend_users.metadata, keeping every other key
- GET /auth/me and the My account answers carry preferences
- phrasebook.Translator.Locales lists the locales defining a prefix
- route tables, conformance cases, OpenAPI document, TS types and docs

modules/cabana/security_coverage_test.go

@@ -40,6 +40,8 @@ var phase09Routes = []adminRoute{
 	{key: "POST /auth/logout", public: true},
 	{key: "GET /auth/me"},
 	{key: "PUT /account"},
+	{key: "GET /account/preferences"},
+	{key: "PUT /account/preferences"},
 	{key: "POST /account/avatar"},
 	{key: "DELETE /account/avatar"},
 	{key: "GET /account/tokens"},