Add the profile page, and publish it as an embeddable panel

Developed in a separate session; committed here alongside the calendar work
that shares this repository's migration journal.

A person can now see their own Plex link, their Watch Now slots and their watch
history at /profile. The same panel is published in two further forms so that
accounts.sticknife.com on charon can carry it as one section of a wider
sticknife profile, next to the other services' sections.

  - watch_history (0024) records what has been played, keyed on the Plex
    history id so a re-sync cannot duplicate a row. Partial unique index,
    because that id is null for anything entered by hand.
  - plex_accounts.is_server_owner (0025) marks the one account whose viewing
    the server files under local account 1 rather than under its plex.tv id.
  - The embed carries its own layout, origin allowlist and a frame-height
    reporter, so the host page can size it without guessing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLANNING.md

@@ -287,9 +287,25 @@ Expected Plex-facing media:
 
 Archive-only media should not normally be visible in Plex unless restored or promoted.
 
+Decided 2026-08-17 — **Ampelos copies Plex watch history into its own
+`watch_history` table** rather than reading it live. Plex prunes its own
+history and a rebuilt server starts empty, so a live read would silently lose
+years of viewing and would go blank whenever the media server was down. The
+copy is also the first signal Ampelos has that says what somebody *finished*
+rather than what they intended, which is the missing input to demotion.
+
+- Only accounts that linked themselves at `/profile` are read, even though the
+  owner's token can reach everybody's. Consent, not capability.
+- History is shown only to the person it belongs to. There is no admin view of
+  who watched what.
+- An episode is attributed to its **series** by the series' external ids, never
+  by title, and never by the episode's own TMDB id — those are different ids
+  and matching on the wrong one would be a collision rather than a match.
+- `plex:history` in ampelos-agent, hourly. Active sessions and user libraries
+  are still not read.
+
 Open decisions:
 
-- Whether Ampelos should read Plex watch history, active sessions, or user libraries directly.
 - Whether existing Plex watchlists remain an input signal.
 - Whether Plex availability should be polled or inferred from filesystem and Ampelos inventory state.