feat(server/m7-user-mgmt): self-service /me endpoints (U3)

Four authenticated endpoints for the user's own account:

- PUT /api/me/password — change own password. Caller must
  supply current_password (verified via bcrypt). Distinct from
  admin-driven reset (which doesn't require knowing the old).
  Audits ActionPasswordChangeSelf.

- PUT /api/me/profile — set display_name + email. Both fields
  are nullable; empty string clears, omitted leaves unchanged.
  Email is lowercased before store + format-validated. Unique
  violation → 409 email_taken.

- GET  /api/me/api-token — returns current API token (for
  copy-paste into Subsonic clients).
- POST /api/me/api-token — regenerates token. Old one stops
  working immediately. Audits ActionTokenRegenerate.

All four use the existing RequireUser middleware on the authed
sub-router; audit writes are best-effort (logged on failure).

Tests cover happy paths, wrong-password 401, password-too-short
400, email-invalid 400, email-taken 409, clear-by-empty-string,
omit-leaves-unchanged, token GET + regen.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/api/api.go

@@ -56,6 +56,10 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playev
 			authed.Get("/me/listenbrainz", h.handleGetListenBrainz)
 			authed.Put("/me/listenbrainz", h.handlePutListenBrainz)
 			authed.Get("/me/history", h.handleGetMyHistory)
+			authed.Put("/me/password", h.handleChangePassword)
+			authed.Put("/me/profile", h.handleUpdateMyProfile)
+			authed.Get("/me/api-token", h.handleGetMyAPIToken)
+			authed.Post("/me/api-token", h.handleRegenerateMyAPIToken)
 
 			authed.Get("/artists", h.handleListArtists)
 			authed.Get("/artists/{id}", h.handleGetArtist)