Account menu + Settings (change password); per-tree home person; full-width tree

- Sidebar bottom-left now shows the signed-in user; clicking opens a menu with
  Settings and Sign out. New /settings page: account info + change password
  (POST /auth/change-password, re-verifies current password). Export/restore/
  delete are stubbed there for the next pass.
- Per-tree default/home person: tree.home_person_id (migration) + TreeUpdate/
  Read; the tree and family views open focused on it; the person page gets a
  "Set as default" control and "Default person" badge. Cleared if that person
  is deleted. Complements the account-level "this is me" link.
- Tree visualization now fills the content area (AppShell drops the max-width
  column on the /tree route); other pages stay centered.
- Audit records are coerced JSON-safe (UUIDs/enums), so PATCHing UUID fields
  like home_person_id audits cleanly.

50 backend tests pass; migration up/down verified; frontend builds.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/api/v1/auth.py

@@ -1,9 +1,10 @@
 from fastapi import APIRouter, HTTPException, Request, Response, status
 
-from app.api.deps import MailerDep, SessionDep, extract_session_token
+from app.api.deps import CurrentUser, MailerDep, SessionDep, extract_session_token
 from app.core.config import get_settings
 from app.schemas.auth import (
     LoginRequest,
+    PasswordChange,
     PasswordResetConfirm,
     PasswordResetRequest,
     RegisterRequest,
@@ -79,3 +80,15 @@ async def reset_password(data: PasswordResetConfirm, session: SessionDep) -> Non
     await auth_service.reset_password(
         session, raw_token=data.token, new_password=data.new_password
     )
+
+
+@router.post("/change-password", status_code=status.HTTP_204_NO_CONTENT)
+async def change_password(
+    data: PasswordChange, session: SessionDep, current: CurrentUser
+) -> None:
+    await auth_service.change_password(
+        session,
+        user=current,
+        current_password=data.current_password,
+        new_password=data.new_password,
+    )