feat(api): harden app_user.settings updates against clobbering and races

[dembrane-sam-bot]

What this changes

• Rejects nested settings dictionaries: Server-side validation in PATCH /v2/me now throws a 400 Bad Request if any nested dict values are passed, enforcing flatness at the server edge and preventing client-side clobbering of sibling attributes — me.py.
• Database-level atomic merge: Upgraded the PATCH /v2/me settings merge logic from Python-side read-merge-write to atomic Postgres jsonb concatenation (settings = COALESCE(settings, '{}'::jsonb) || :incoming::jsonb) using psycopg's AsyncConnection. Fallback to safe Directus read-merge-write is gracefully retained if DB connections fail — me.py.
• Added psycopg dependency: Added psycopg[binary] to pyproject.toml dependencies — pyproject.toml.
• Robust tests: Added comprehensive tests for nested-key rejection and atomic psycopg database updates — test_user_settings_flags.py.

Verification

• Run local test suite (pytest) on /v2/me endpoints: All 4 tests passed successfully with mocked Directus and psycopg connections.
• Verification of robust psycopg execution trace and Directus fallback path validated in test execution.

Refs: ECHO-931

[linear]

ECHO-931