feat(server): harden app_user.settings updates with atomic database-level merge

[dembrane-sam-bot]

What this changes

• Hardens app_user.settings updates by implementing database row-level locking (SELECT ... FOR UPDATE) in PATCH /v2/me, completely eliminating concurrent read-merge-write race conditions — me.py.
• Implements a recursive deep_merge helper in Python, ensuring that nested dictionaries within settings are merged rather than wholesale replaced, protecting sibling keys from being clobbered — me.py.
• Separates Directus-based display_name updates from direct Postgres-based settings updates cleanly — me.py.
• Adds robust unit/integration tests verifying deep_merge (flat keys, nested structures, type mismatch fallbacks) and update_user_settings_atomic correctness (valid transactions, 404 raised on missing user) — test_me_settings_atomic.py.

Why this is needed

The prior implementation performed a shallow merge in Python ({**existing_settings, **body.settings}) inside the API handler and wrote the full dict back. This suffered from:

1. Shallow merge limitations: Any writer sending a nested dictionary under a shared parent would replace the entire parent object, silently dropping its other nested siblings.
2. Read-merge-write race: Concurrent PATCH calls from different tabs or client actions could read the stale state at the same time, merge, and overwrite each other, causing silent clobbering.

This change acquires an atomic transaction lock on the specific row in PostgreSQL, deep-merges recursively, and updates atomically.

Closes: ECHO-933

[linear]

ECHO-933