feat(profiles): multi-user profiles with PIN switching

A shared device can hold several accounts from the same server and switch
between them in a couple of taps. A profile can be locked behind a 4-8
digit PIN; one without a PIN is one tap away. Forgetting a PIN falls
through to the account's own Jellyfin password, so there is no reset flow
and no recovery secret to store.

Opt-in by construction: a single account with no PIN starts, plays and
downloads exactly as before, and never sees a picker.

Two decisions worth keeping:

- Switching is not logging out. auth_logout invalidates the token
  server-side, which is precisely what a switch must not do, or every
  switch back would cost a password. The switch runs as a plan
  (profiles/switch.rs) so the teardown *ordering* is unit-testable with
  no player and no server -- a straggler reporting after the active user
  flips would attribute one account's viewing to another, silently.

- The PIN gates switching, not the token at rest. Wrapping each token
  with its PIN would leave a locked profile unable to resume its own
  downloads or drain its own sync queue until somebody typed the code,
  which on a device that reboots nightly costs more than it defends
  against a four-digit secret. auth_initialize does refuse to restore a
  PIN-protected session, so the gate is on the session rather than on
  which screen is shown.

"Child account" is not modelled anywhere -- a child's profile is simply
one with no PIN. The frontend renders an opaque unlockMethod and never
compares a PIN, counts an attempt or infers a role.

Migration 024 adds user_pins, user_item_visibility, user_libraries and
download_grants, and backfills the existing user so an upgrade does not
blank its library. The visibility and grant tables are the schema half of
the cache-scoping and shared-download work; the read-path enforcement is
still to come (see docs/specs/multi-user-profiles.md).

src-tauri/src/lib.rs

@@ -15,6 +15,7 @@ mod media_server;
 mod playback_mode;
 mod playback_reporting;
 mod player;
+mod profiles;
 mod repository;
 mod session_poller;
 pub mod settings;
@@ -194,6 +195,15 @@ use commands::{
     playlist_move_item,
     playlist_remove_items,
     playlist_rename,
+    profiles_add,
+    profiles_get_ask_on_start,
+    profiles_list,
+    profiles_remove,
+    profiles_set_ask_on_start,
+    profiles_set_pin,
+    profiles_startup_target,
+    profiles_unlock,
+    profiles_unlock_with_password,
     // Remote session control commands
     remote_play_on_session,
     remote_send_command,
@@ -1036,6 +1046,15 @@ fn specta_builder() -> Builder<tauri::Wry> {
             playlist_rename,
             playlist_get_items,
             playlist_add_items,
+            profiles_add,
+            profiles_get_ask_on_start,
+            profiles_list,
+            profiles_remove,
+            profiles_set_ask_on_start,
+            profiles_set_pin,
+            profiles_startup_target,
+            profiles_unlock,
+            profiles_unlock_with_password,
             playlist_remove_items,
             playlist_move_item,
             // Diagnostics commands