docs: add Bruno collection entries for settings endpoints

bruno/AppView API/Settings/Get Settings Page.bru

···
+meta {
+  name: Get Settings Page
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{web_url}}/settings
+}
+
+assert {
+  res.status: eq 200
+}
+
+docs {
+  Renders the user settings page.
+
+  Requires authentication (session cookie). Unauthenticated users are redirected
+  to /login (302).
+
+  Returns HTML page containing:
+  - Light-theme <select id="lightThemeUri"> when allowUserChoice is true
+  - Dark-theme <select id="darkThemeUri"> when allowUserChoice is true
+  - Informational banner when allowUserChoice is false
+  - "Preferences saved." banner when ?saved=1 query param is present
+  - Error banner when ?error=<message> query param is present
+  - <div id="theme-preview"> HTMX swap target
+
+  Both selects carry HTMX attributes:
+    hx-get="/settings/preview"
+    hx-trigger="change"
+    hx-target="#theme-preview"
+    hx-swap="outerHTML"
+    hx-include="this"
+
+  Query parameters:
+  - saved: "1" (optional) — shows "Preferences saved." success banner
+  - error: string (optional) — shows decoded error message in error banner
+
+  Error codes:
+  - 302: Not authenticated → redirects to /login
+  - 200: Success — page rendered (with or without selects depending on policy)
+}

bruno/AppView API/Settings/Preview Theme.bru

···
+meta {
+  name: Preview Theme
+  type: http
+  seq: 2
+}
+
+get {
+  url: {{web_url}}/settings/preview?lightThemeUri=at://{{forum_did}}/space.atbb.forum.theme/3lbllight
+}
+
+params:query {
+  lightThemeUri: at://{{forum_did}}/space.atbb.forum.theme/3lbllight
+}
+
+assert {
+  res.status: eq 200
+}
+
+docs {
+  HTMX endpoint — returns an HTML fragment with color swatches for the given theme.
+
+  Called automatically by the settings page when the user changes a theme select.
+  Returns a <div id="theme-preview"> fragment that HTMX swaps into the page.
+
+  Accepts exactly one of:
+  - lightThemeUri: AT URI of a light theme
+  - darkThemeUri: AT URI of a dark theme
+
+  The endpoint fetches the theme from the AppView by rkey, extracts these tokens:
+    color-bg, color-surface, color-primary, color-text, color-border
+
+  Returns the fragment:
+    <div id="theme-preview" class="theme-preview">
+      <span class="theme-preview__name">Theme Name</span>
+      <div class="theme-preview__swatches">
+        <span class="theme-preview__swatch" style="background:#hex" title="color-bg" />
+        ...
+      </div>
+    </div>
+
+  Returns empty fragment on any of:
+  - No query param provided
+  - URI fails rkey extraction (malformed)
+  - AppView returns non-ok status (unknown theme)
+  - Network error reaching AppView
+
+  Error codes:
+  - 200: Always — never errors, returns empty fragment on failure
+    Empty fragment: <div id="theme-preview"></div>
+}

bruno/AppView API/Settings/Save Appearance.bru

···
+meta {
+  name: Save Appearance
+  type: http
+  seq: 3
+}
+
+post {
+  url: {{web_url}}/settings/appearance
+}
+
+body:form {
+  lightThemeUri: at://{{forum_did}}/space.atbb.forum.theme/3lbllight
+  darkThemeUri: at://{{forum_did}}/space.atbb.forum.theme/3lbldark
+}
+
+assert {
+  res.status: eq 302
+  res.headers.location: contains /settings
+}
+
+docs {
+  Saves the user's light and dark theme preferences as cookies.
+
+  Requires authentication (session cookie). Unauthenticated users are redirected
+  to /login (302).
+
+  Body parameters (application/x-www-form-urlencoded):
+  - lightThemeUri: string (required) — AT URI of the chosen light theme
+  - darkThemeUri: string (required) — AT URI of the chosen dark theme
+
+  Validation:
+  1. Both URIs must be non-empty strings
+  2. Forum theme policy is re-fetched fresh (bypasses cache) to prevent stale themes
+  3. allowUserChoice must be true in the policy
+  4. Both URIs must be present in policy.availableThemes
+
+  On success:
+  - Sets cookie: atbb-light-theme=<uri>; Path=/; Max-Age=31536000; SameSite=Lax
+  - Sets cookie: atbb-dark-theme=<uri>; Path=/; Max-Age=31536000; SameSite=Lax
+  - Redirects 302 to /settings?saved=1
+
+  Error codes:
+  - 302 → /login: Not authenticated
+  - 302 → /settings?error=invalid: Missing or non-string body fields
+  - 302 → /settings?error=unavailable: Policy fetch failed (no cookies set)
+  - 302 → /settings?error=not-allowed: allowUserChoice is false
+  - 302 → /settings?error=invalid-theme: URI not in availableThemes
+  - 302 → /settings?saved=1: Success (cookies set)
+}