feat(profiles): manage PINs from settings

Settings had only an ask-on-start toggle and a button that bounced to the
picker, so there was nowhere to actually turn a PIN on or off -- the one
part of this feature that genuinely is configuration rather than a
front-door action.

Scoped to the active profile on purpose. Letting a signed-in session set
a PIN on someone else's profile is an escalation path with no real use:
a PIN-less profile could be locked by whoever is standing at the device,
and its owner pushed down the password route to get back into their own
account. Other profiles are listed read-only so a parent can see which
are protected; adding and removing them stays on the picker, which
settings now deep-links into with ?manage=1 rather than growing a second
copy of the tile list.

Form validation is extracted to pinForm.ts and unit-tested -- shape only,
so the form can say what is wrong before submitting. Rust validates again
and remains the only thing that ever compares a PIN.

src/routes/settings/+page.svelte

@@ -1,9 +1,9 @@
 <!-- TRACES: UR-023, UR-025, UR-027, UR-029, UR-057, UR-076 | DR-030, DR-048, DR-077, DR-086, DR-132, DR-209 -->
 <script lang="ts">
   import { onDestroy, onMount } from "svelte";
-  import { goto } from "$app/navigation";
   import { commands } from "$lib/api/bindings";
   import { profiles } from "$lib/stores/profiles";
+  import ProfileSecuritySettings from "$lib/components/settings/ProfileSecuritySettings.svelte";
   import type {
     AudioSettings,
     CacheConfig,
@@ -1022,16 +1022,12 @@
           </div>
 
           <div class="border-t border-gray-700 pt-5">
-            <p class="text-sm text-gray-400 mb-3">
+            <ProfileSecuritySettings />
+            <p class="text-xs text-gray-500 mt-4">
               A PIN controls who can switch to an account on this device. What each account is
-              allowed to watch is set on the Jellyfin server, not here.
+              allowed to watch is set on the Jellyfin server, not here. Switching profile lives in
+              the account menu.
             </p>
-            <button
-              onclick={() => goto("/profiles")}
-              class="px-4 py-2 bg-[var(--color-jellyfin)] hover:bg-[var(--color-jellyfin-dark)] rounded-lg font-medium transition-colors"
-            >
-              Switch or manage profiles
-            </button>
           </div>
         </div>
       </div>