docs: 更新协议文档，删除废弃计划文档

- 更新 http-error-codes, user-points-chat-data-protocol
- 更新 divination-run-protocol, profile-protocol
- 删除废弃的后端和前端设计计划文档

docs/protocols/profile/profile-protocol.md

@@ -4,19 +4,23 @@ This document defines the canonical backend contract for user profile read/write
 
 Protocol verification status:
 
-- Backend model source: `backend/src/models/profile.py`
+- Backend route source: `backend/src/v1/users/router.py`
+- Backend schema source: `backend/src/v1/users/schemas.py`
+- Backend service source: `backend/src/v1/users/service.py`
+- Frontend mapping source: `apps/lib/features/settings/data/apis/profile_api.dart`
 - Storage config source: `backend/src/core/config/settings.py`
-- Current status: planned
+- Current status: aligned
 
 ## Compatibility strategy
 
-- Current strategy: breaking changes allowed during implementation phase (no production compatibility burden).
-- Once production compatibility is required, switch to additive-only evolution.
+- Current strategy: additive evolution (`backward-compatible`).
+- Breaking change requires explicit migration + rollback notes (`requires-migration`).
 
 ## Route overview
 
 - Get profile: `GET /api/v1/users/me/profile`
 - Update profile: `PATCH /api/v1/users/me/profile`
+- Update settings: `PATCH /api/v1/users/me/settings`
 - Create avatar upload url: `POST /api/v1/users/me/avatar/upload-url`
 - Upload avatar directly: `POST /api/v1/users/me/avatar` (multipart)
 
@@ -84,6 +88,40 @@ Response:
 
 - Returns the same shape as `GET /users/me/profile`.
 
+## Settings update contract
+
+### `PATCH /api/v1/users/me/settings`
+
+Request:
+
+```json
+{
+  "settings": {
+    "version": 1,
+    "preferences": {
+      "interface_language": "zh-CN",
+      "ai_language": "zh-CN",
+      "timezone": "Asia/Shanghai",
+      "country": "CN"
+    },
+    "privacy": {},
+    "notification": {
+      "allow_notifications": true,
+      "allow_vibration": true
+    }
+  }
+}
+```
+
+Rules:
+
+- `settings` must conform to `ProfileSettingsV1`.
+- Additional fields are forbidden.
+
+Response:
+
+- Returns the same shape as `GET /users/me/profile`.
+
 ## Avatar upload signing contract
 
 ### `POST /api/v1/users/me/avatar/upload-url`