feat(server): auth status, attachments list, user preferences

GET auth/status ({ hasUsers }), GET attachments?entity=&entityId= (owner
scoped, 404 for foreign targets) and GET/PATCH me/preferences (ratingScale,
defaultVisibility in users.preferences).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/core/src/auth.ts

@@ -111,6 +111,11 @@ export async function login(
   return { user: toUser(row), sessionToken };
 }
 
+/** True once any account exists (the first one becomes admin). */
+export async function hasUsers(db: Db): Promise<boolean> {
+  return (await db.k.selectFrom("users").select("id").limit(1).executeTakeFirst()) !== undefined;
+}
+
 export async function getSessionUser(db: Db, token: string): Promise<User | null> {
   const row = await db.k
     .selectFrom("sessions")