settings: add self-service user settings page

API endpoints (all auth-gated to the logged-in user):
- GET  /api/me/storage        — per-category disk breakdown
- DELETE /api/me/originals    — free originals/ dir (post-extraction cleanup)
- DELETE /api/me/activities   — wipe all activity data (password confirm)
- DELETE /api/me              — delete account + all data (password confirm)
- PUT  /api/me/display-name   — update display name
- PUT  /api/me/password       — change password (requires current password)

Page at /settings/:
- Storage card: activities / originals / Strava originals / photos / total
  with one-click 'Delete original files' when originals exist
- Profile card: display name field with inline save
- Password card: change password form
- Danger zone: delete all activities or delete account (both require
  password confirmation in a modal before proceeding)

Nav: 'Settings' link appears in the top bar after login (same as Admin).

site/src/layouts/Base.astro

@@ -200,6 +200,13 @@ try {
               title=""
               class="text-xs px-2 py-0.5 rounded-full bg-amber-900/60 text-amber-300 border border-amber-700/50 animate-pulse cursor-default"
             ></span>
+            <!-- Settings link — hidden until logged in -->
+            <a
+              id="nav-settings"
+              href={`${baseUrl}settings/`}
+              style="display:none"
+              class="text-xs text-zinc-500 hover:text-white transition-colors px-1"
+            >Settings</a>
             <!-- Admin link — hidden until confirmed admin -->
             <a
               id="nav-admin"
@@ -494,7 +501,9 @@ try {
             el.href = baseUrl + 'u/' + user.handle + '/' + el.getAttribute('data-user-path');
           });
 
-          // Show logout button
+          // Show settings + logout links
+          const settingsEl = document.getElementById('nav-settings');
+          if (settingsEl) settingsEl.style.display = '';
           const logoutEl = document.getElementById('nav-logout');
           if (logoutEl) logoutEl.style.display = '';