feat(5.2): add User Preferences API with full-stack implementation

Backend:
- Create app/models/user_preference.py with TenantMixin (user_id, key, value JSONB)
- Create app/routes/user_preferences.py with GET/PUT/DELETE endpoints + RBAC
- Add user_preferences:read/write to CORE_PERMISSIONS
- Add user_preferences to legacy role permissions (admin/editor/viewer)
- Register route in app/main.py and app/routes/__init__.py
- Create alembic migration 0028_user_preferences
- Add UserPreference model to conftest.py for test schema
- Fix pre-existing conftest seed (Contact industry field removed in migration 0027)

Frontend:
- Create frontend/src/api/userPreferences.ts with React Query hooks
- Create frontend/src/hooks/useUserPreferences.ts syncing with uiStore
- Add i18n entries for de.json and en.json

Tests:
- 13 tests covering CRUD, tenant isolation, CSRF, unauthenticated access
- All tests passing

app/core/permissions.py

@@ -162,12 +162,14 @@ async def resolve_permissions(
                         "sequences:read", "sequences:write", "addresses:read", "addresses:write",
                         "taxes:read", "taxes:write", "currencies:read", "currencies:write",
                         "notifications:read", "notifications:write", "import_export:read",
-                        "import_export:write"}
+                        "import_export:write",
+                        "user_preferences:read", "user_preferences:write"}
         elif legacy_role == "viewer":
             allowed |= {"contacts:read", "contacts:read", "users:read", "roles:read",
                         "audit:read", "attachments:read", "workflows:read", "sequences:read",
                         "addresses:read", "taxes:read", "currencies:read",
-                        "notifications:read", "import_export:read"}
+                        "notifications:read", "import_export:read",
+                        "user_preferences:read", "user_preferences:write"}
 
     # Load group permissions
     ug_q = select(UserGroup).where(