feat(auth,privacy,web): step-by-step login, privacy settings persistence, TOTP QR, and API docs

app/users/router.py

@@ -65,6 +65,9 @@ async def update_profile(
         bio=payload.bio,
         avatar_url=payload.avatar_url,
         allow_private_messages=payload.allow_private_messages,
+        privacy_last_seen=payload.privacy_last_seen,
+        privacy_avatar=payload.privacy_avatar,
+        privacy_group_invites=payload.privacy_group_invites,
     )
     return updated