feat(l1): PATCH /accounts/me/members/{id}/coverage for engineer L1-coverage flag

Owner-only endpoint to toggle can_cover_l1 on an engineer user. 422 if target
role is not engineer (owners/super_admins already see L1 surface; viewers/
l1_techs don't need this flag). 404 for cross-account targets.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/app/schemas/user.py

@@ -60,6 +60,7 @@ class UserResponse(UserBase):
     email_verified_at: Optional[datetime] = None
     onboarding_step_completed: Optional[int] = None
     onboarding_dismissed: bool = False
+    can_cover_l1: bool = False
 
     class Config:
         from_attributes = True
@@ -73,3 +74,7 @@ class AccountRoleUpdate(BaseModel):
     # Ownership changes must go through the explicit transfer-ownership flow so
     # account.owner_id stays consistent with user.account_role.
     account_role: str = Field(..., pattern="^(admin|engineer|viewer|l1_tech)$")
+
+
+class CoverageUpdate(BaseModel):
+    can_cover_l1: bool