Lifts the session out of /explore-only territory and onto every page, adds a sign-in / account dropdown to the nav, and ships a first-class account settings page where users can personalize the waypoint catalog. * AtprotoSessionProvider moves to the root layout so the OAuth session is available on every route (homepage, universal links, account, explore, …). Explore layout drops its local wrapper. * SessionMenu — header dropdown: \"Sign in\" button when signed out, avatar pill with display name + menu (my repo / account settings / sign out) when signed in. Wired into all three Header modes (compact / simple / default). * /account — gated settings page. When signed out, shows a sign-in form that walks through OAuth. When signed in, renders the user's profile header, PDS sync status, and the WaypointsManager. * WaypointsManager — drag-and-drop reorder (via @dnd-kit), per-row show/hide eye toggle, and full CRUD for custom waypoints with URL templates supporting {handle} / {did} / {actor} / {collection} / {rkey} placeholders. * PreferencesProvider — hybrid storage: localStorage primary, optionally mirrored to the user's PDS as a to.aturi.actor.preferences/self record. On sign-in the two are reconciled by updatedAt (newer wins) and the loser is pushed back so cross-device sync settles automatically. PDS writes are debounced 1.5s so burst edits collapse into a single network call. * WaypointPicker now consumes prefs: hidden built-ins disappear, the user's order is applied within each category, and custom waypoints show up under a new \"My Waypoints\" group on every universal link page. Anonymous users still get the default catalog; they can also customize locally without signing in (changes live in localStorage and stay per-device until they sign in, at which point they migrate up to the PDS).