fix: don't save settings immediately after login

The save-settings $effect was firing on the initial data load because
settingsApplied was set to true synchronously in the apply effect, then
currentTheme/fontFamily/fontSize were written in the same tick — causing
the save effect to immediately fire with uninitialized default values
(theme: "", fontFamily: "", fontSize: 0), producing a 400 error.

- Add settingsDirty flag, set via setTimeout(0) after initial apply so
  the save effect is blocked for the first load and only runs on real
  user-driven changes
- Also accept empty string / 0 as 'not provided' in PUT /api/settings
  validation as a defensive backstop

ui/src/routes/+layout.svelte

@@ -88,6 +88,7 @@
 	// Apply persisted settings once on mount (server-loaded data).
 	// Use a derived to react to future invalidateAll() re-loads too.
 	let settingsApplied = false;
+	let settingsDirty = false; // true only after the first apply completes
 	$effect(() => {
 		if (data.settings) {
 			if (!settingsApplied) {
@@ -100,6 +101,9 @@
 			currentTheme = data.settings.theme ?? 'amber';
 			currentFontFamily = data.settings.fontFamily ?? 'system';
 			currentFontSize = data.settings.fontSize ?? 1.0;
+			// Mark dirty only after the synchronous apply is done so the save
+			// effect doesn't fire for this initial load.
+			setTimeout(() => { settingsDirty = true; }, 0);
 		}
 	});
 
@@ -114,8 +118,9 @@
 		const fontFamily = currentFontFamily;
 		const fontSize = currentFontSize;
 
-		// Skip saving until settings have been applied from the server
-		if (!settingsApplied) return;
+		// Skip saving until settings have been applied from the server AND
+		// at least one user-driven change has occurred after that.
+		if (!settingsDirty) return;
 
 		clearTimeout(settingsSaveTimer);
 		settingsSaveTimer = setTimeout(() => {