feat(core/backend): account settings endpoints (profile PATCH / change password / avatar upload)

§4 settings-save backend (no schema change; User already has phone/avatar_url):
- me/ now GET+PATCH (update name/phone/email)
- POST me/password/ — verify old password, set new (>=8), reissue token
- POST me/avatar/ — multipart -> TOS upload -> presigned avatar_url
Verified: profile PATCH 200, password change round-trip 200, original login restored.
Note: notification/theme prefs have no User storage field -> will persist client-side (no migrate per rules).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/backend/apps/accounts/urls.py

@@ -1,6 +1,16 @@
 from django.urls import path
 
-from .views import login, logout, me, register, team_member_detail, team_member_password, team_members
+from .views import (
+    change_password,
+    login,
+    logout,
+    me,
+    register,
+    team_member_detail,
+    team_member_password,
+    team_members,
+    update_avatar,
+)
 
 
 urlpatterns = [
@@ -8,6 +18,8 @@ urlpatterns = [
     path("login/", login, name="auth-login"),
     path("logout/", logout, name="auth-logout"),
     path("me/", me, name="auth-me"),
+    path("me/password/", change_password, name="auth-change-password"),
+    path("me/avatar/", update_avatar, name="auth-avatar"),
     path("team/members/", team_members, name="team-members"),
     path("team/members/<uuid:member_id>/", team_member_detail, name="team-member-detail"),
     path("team/members/<uuid:member_id>/password/", team_member_password, name="team-member-password"),