feat(privacy): add private-message permission toggle

app/users/service.py

@@ -40,6 +40,7 @@ async def update_user_profile(
     username: str | None = None,
     bio: str | None = None,
     avatar_url: str | None = None,
+    allow_private_messages: bool | None = None,
 ) -> User:
     if name is not None:
         user.name = name
@@ -49,6 +50,8 @@ async def update_user_profile(
         user.bio = bio
     if avatar_url is not None:
         user.avatar_url = avatar_url
+    if allow_private_messages is not None:
+        user.allow_private_messages = allow_private_messages
     await db.commit()
     await db.refresh(user)
     return user