feat(tiles): store dashboard and profile tile layouts

readme.md

@@ -35,10 +35,12 @@ To Be Played is split into three repositories:
 - Appearance settings synced across devices: accent color, corner style, wide layout, background and dashboard
   banner from the user's own game art. Only whitelisted presets and Steam app ids are stored, never raw CSS or URLs.
 - Opt-in public profile at `/u/<display name>`. Auth answers with a short-lived **profile ticket** (EdDSA JWT,
-  10 minutes, `typ=public-profile`) that Core accepts for the public library data only. Its `profileStats` claim
-  names the stat groups the user chose to show there (none by default), its `sections` claim the parts of the
-  profile the user shows. The profile has its own look (accent, corners, banner and background from own game art,
-  sections in order), apart from the app appearance, and the public answer sends it as `style`. The ticket is not a login:
+  10 minutes, `typ=public-profile`) that Core accepts for the public library data only. The profile has its own
+  look (accent, corners, banner and background from own game art) and a **tile layout** (`profile_tiles`: the shown
+  tiles in order, each with a size S, M or L), apart from the app appearance; the public answer sends both as
+  `style`. The ticket's claims come from the layout: `sections` names the shown parts (`STATS` when any `STATS_`
+  tile is shown), `profileStats` the stat groups of the `STATS_` tiles. The user's dashboard layout
+  (`dashboard_tiles`, NULL = never changed) is stored the same way. The ticket is not a login:
   both services reject every token with a `typ` claim on normal endpoints.
 - **Roles**: one per user, a ladder `USER < AUDITOR < PLATFORM_ADMIN` (`users.role`, the first admin is set by
   SQL). The access token carries the active role in the `role` claim. **View as**: an admin switches the own login
@@ -91,8 +93,9 @@ To Be Played is split into three repositories:
 | `DELETE` | `/api/users/me` (`{password}`; `204` and both cookies cleared, `403 INVALID_PASSWORD`, `429`) | access token |
 | `GET` | `/api/steam-link/callback` | public, Steam's redirect back; binding cookie; redirects to the frontend settings |
 | `PUT` | `/api/users/settings/appearance` | access token |
-| `PUT` | `/api/users/settings/profile-stats` (`{groups}`: `PILE`, `TOP_GAMES`, `TASTE`, `HABITS`, `FINISHED`, `TREND`; `204`) | access token |
-| `PUT` | `/api/users/settings/profile-style` (`{accent, corners, bannerAppid, backgroundAppid, sections}`, sections from `SUMMARY`, `STATUS`, `PLAYING`, `FINISHED`, `STATS` in their order; `204`) | access token |
+| `PUT` | `/api/users/settings/profile-style` (`{accent, corners, bannerAppid, backgroundAppid}`; `204`) | access token |
+| `PUT` | `/api/users/settings/dashboard-tiles` (`{tiles: [{id, size}]}` in order, at most 20; `{tiles: null}` resets; `204`) | access token |
+| `PUT` | `/api/users/settings/profile-tiles` (`{tiles: [{id, size}]}`: `SUMMARY`, `STATUS`, `PLAYING`, `FINISHED`, `STATS_<GROUP>`; `204`) | access token |
 | `GET` | `/api/public/profiles/{displayName}` | public |
 | `GET` | `/api/stats/public` | public |
 | `GET` | `/api/version` (`{commit, builtAt}` of the running image, from the CI build; `dev` locally) | public |