feat: add access profile selection support with device-specific profile persistence

Add SelectOwnProfile handler to allow users to choose from available access profiles. Store selected profile ID per device in settings table with device_access_profile category. Implement GetSelectedProfileID and SetSelectedProfileID repository methods using JSONB storage.

Add ListSelectableProfiles to policy repository and service to query user/group/device-specific profiles ordered by priority. Filter gateway

backend/internal/device/handler.go

@@ -113,6 +113,28 @@ func (h *Handler) GetOwnProfile(w http.ResponseWriter, r *http.Request) {
 	apiutil.JSON(w, http.StatusOK, response)
 }
 
+func (h *Handler) SelectOwnProfile(w http.ResponseWriter, r *http.Request) {
+	userID, ok := requestctx.MustUserID(r.Context())
+	if !ok {
+		apiutil.Error(w, http.StatusUnauthorized, "unauthorized", "missing auth claims")
+		return
+	}
+
+	var input SelectProfileRequest
+	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
+		apiutil.Error(w, http.StatusBadRequest, "invalid_json", "invalid request body")
+		return
+	}
+
+	response, err := h.service.SelectProfile(r.Context(), userID, input.ProfileID)
+	if err != nil {
+		apiutil.Error(w, http.StatusBadRequest, "profile_selection_failed", err.Error())
+		return
+	}
+
+	apiutil.JSON(w, http.StatusOK, response)
+}
+
 func (h *Handler) GetProfileByDeviceID(w http.ResponseWriter, r *http.Request) {
 	deviceID, err := uuid.Parse(chi.URLParam(r, "id"))
 	if err != nil {