feat: profile/settings (rest timer toggle)

Settings infrastructure + one working preference:

- New user_settings table (JSON blob per user, so adding
  future keys needs no migration).
- db.get_settings / update_settings helpers (merge semantics).
- GET/PUT /api/settings endpoints.
- New Settings tab in the Mini App with a rest-timer on/off
  toggle. Setting is loaded on init and written through on
  change; the rest-timer display now respects it.

Units (kg/lb) and language are intentionally left unwired for
now — each needs end-to-end display/input changes and deserve
focused passes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server.py

@@ -17,7 +17,7 @@ from urllib.parse import parse_qs
 
 from aiohttp import web
 
-from db import init_db, save_workout, get_workouts, get_workout_count, get_stats_sql, delete_workout, update_workout, export_workouts, get_user_workout_number, get_all_exercise_names, log_event
+from db import init_db, save_workout, get_workouts, get_workout_count, get_stats_sql, delete_workout, update_workout, export_workouts, get_user_workout_number, get_all_exercise_names, log_event, get_settings, update_settings
 from parser import parse_workout, format_workout
 
 logging.basicConfig(
@@ -302,6 +302,25 @@ async def api_version(request: web.Request):
     return web.json_response({"version": _VERSION})
 
 
+@require_auth
+async def api_get_settings(request: web.Request):
+    """Return the authenticated user's settings dict."""
+    return web.json_response({"settings": get_settings(request["user_id"])})
+
+
+@require_auth
+async def api_update_settings(request: web.Request):
+    """Merge a partial settings patch; returns the full updated settings."""
+    try:
+        body = await request.json()
+    except (ValueError, json.JSONDecodeError):
+        return web.json_response({"error": "Invalid JSON"}, status=400)
+    if not isinstance(body, dict):
+        return web.json_response({"error": "Body must be an object"}, status=400)
+    updated = update_settings(request["user_id"], body)
+    return web.json_response({"settings": updated})
+
+
 @require_auth
 async def api_log_event(request: web.Request):
     """Record a client-emitted event (Mini App telemetry)."""
@@ -352,6 +371,8 @@ def create_app() -> web.Application:
     app.router.add_get("/api/export/csv", api_export_csv)
     app.router.add_get("/api/version", api_version)
     app.router.add_post("/api/events", api_log_event)
+    app.router.add_get("/api/settings", api_get_settings)
+    app.router.add_put("/api/settings", api_update_settings)
 
     # Serve the webapp/ folder
     webapp_dir = pathlib.Path(__file__).parent / "webapp"