feat(user-settings): avatar delete + accent color

- DELETE /users/me/avatar endpoint with file cleanup
- PATCH /users/me/accent-color with hex validation (#rrggbb)
- auth.service.ts: include accentColor in user select
- AccountSettingsForm: delete-avatar button + accent color picker/save/reset
- auth-actions.ts: deleteAvatarAction + updateAccentColorAction

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/lib/auth-actions.ts

@@ -14,6 +14,7 @@ export interface AuthUser {
   mustChangePassword: boolean;
   isLocalUser?: boolean;
   hasAvatar?: boolean;
+  accentColor?: string | null;
 }
 
 export interface LoginResult {
@@ -200,6 +201,41 @@ export async function uploadAvatarAction(
   }
 }
 
+export async function deleteAvatarAction(): Promise<{ success: boolean; error?: string }> {
+  const cookieStore = await cookies();
+  const session = cookieStore.get('session')?.value;
+  if (!session) return { success: false, error: 'notAuthenticated' };
+  try {
+    const response = await fetch(`${API_URL}/users/me/avatar`, {
+      method: 'DELETE',
+      headers: { Cookie: `session=${session}` },
+    });
+    if (!response.ok) return { success: false, error: 'deleteError' };
+    return { success: true };
+  } catch {
+    return { success: false, error: 'networkError' };
+  }
+}
+
+export async function updateAccentColorAction(
+  color: string | null,
+): Promise<{ success: boolean; error?: string }> {
+  const cookieStore = await cookies();
+  const session = cookieStore.get('session')?.value;
+  if (!session) return { success: false, error: 'notAuthenticated' };
+  try {
+    const response = await fetch(`${API_URL}/users/me/accent-color`, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json', Cookie: `session=${session}` },
+      body: JSON.stringify({ color }),
+    });
+    if (!response.ok) return { success: false, error: 'saveError' };
+    return { success: true };
+  } catch {
+    return { success: false, error: 'networkError' };
+  }
+}
+
 /**
  * Fetch the current authenticated user from the API.
  * Uses the session cookie for authentication.