Add opt-in racer preferences and discovery filters

## Goal

After the Friend System MVP is stable, help cubers discover compatible racers beyond people they have already met in a room.

## Candidate profile fields

All fields must be optional, coarse, and independently hideable:

- preferred WCA events;
- language tags;
- timezone or broad availability windows;
- self-described pace bands per event.

Do not infer or publish age, exact location, email, hidden WCA identity, or solve history.

## Discovery contract

- Users are excluded from recommendations by default until they opt in.
- Filters and recommendations must respect blocks and profile visibility.
- Explain why a result matched; do not create opaque global rankings.
- Keep search bounded and rate-limited and provide a way to leave discovery immediately.
- Validate demand with Friend System usage before choosing the final fields or ranking logic.

## Acceptance criteria

- [ ] Research which two or three fields users will actually maintain and document the privacy tradeoffs.
- [ ] Add profile visibility and discovery opt-in controls with safe defaults.
- [ ] Define coarse, validated values rather than unrestricted location/speed text where possible.
- [ ] Add filtered discovery with pagination, rate limits, block enforcement, and explicit empty states.
- [ ] Add data retention/deletion behavior and privacy-safe adoption metrics.
- [ ] Test hidden fields, opt-out, blocking, pagination, and unauthorized access.

## Dependencies

- #75
- #82
- #188

## Non-goals

- Exact geolocation.
- Age-based matching.
- Automatic competitive ratings.
- Shipping as part of the Friend System MVP.

Beginne mit der Überprüfung der Abhängigkeiten #75, #82 und #188 und validiere anschließend den Bedarf anhand der Nutzung von Friend System, bevor du die Profilfelder oder die Ranking-Logik festlegst. Als abgeschlossen gilt die Aufgabe, wenn die Abwägungen zum Datenschutz und die ausgewählten Felder dokumentiert sind und die Discovery-Steuerelemente, Filter, Sicherheitsmaßnahmen, das Aufbewahrungsverhalten sowie die aufgeführten Datenschutz- und Zugriffstests vorhanden sind.

Vom Indexierungsmodell aus dem Issue-Text verfasst.