Per-service locale override: effective locale chain, PATCH /me validation ...

users.locale is now purely the per-service override chosen in settings;
the auth-derived default lives in users.profile.locale and is never
written back over the override by login or the webhook. PATCH /me
normalizes language tags (en-US -> en), accepts auto to clear, and
rejects unsupported locales with 422. UserRead gains locale_effective
(override -> profile -> en) which the web UI and the extension use as
their UI language. The validation error handler strips non-serializable
pydantic ctx.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Implement initial gnexus-creds MVP scaffold