User profile: default PAT and dotfiles for new sessions

[gatof81]

Goal

Reduce the friction of re-entering the same PAT and dotfiles URL on every session by storing them on the user profile and auto-populating the create-session form.

Scope

• New user_profile columns / table holding:
  • default_pat_ciphertext / iv / tag (reuses Env vars & secrets: typed entries, AES-GCM-encrypted secrets, .env paste #186 crypto).
  • default_dotfiles_url, default_dotfiles_ref, default_dotfiles_install_script.
  • default_git_name, default_git_email.
• New routes: GET /api/me/profile, PUT /api/me/profile. PAT is write-only (returned as { isSet: true }).
• Create-session form pre-populates the auth subpanel, dotfiles section, and git identity from the profile when present. Per-session override is still possible.
• Frontend: dedicated profile page for editing.

Acceptance

• Setting a PAT on the profile makes it the default for new sessions; per-session override wins when set.
• Setting dotfiles on the profile pre-populates the dotfiles section.
• Setting git identity on the profile pre-populates name/email.
• Profile values never bleed into existing sessions.

Related

Related to #184 (this is a UX layer over the per-session creds the umbrella adds).