feat(5.2): add User Preferences API with full-stack implementation

Backend:
- Create app/models/user_preference.py with TenantMixin (user_id, key, value JSONB)
- Create app/routes/user_preferences.py with GET/PUT/DELETE endpoints + RBAC
- Add user_preferences:read/write to CORE_PERMISSIONS
- Add user_preferences to legacy role permissions (admin/editor/viewer)
- Register route in app/main.py and app/routes/__init__.py
- Create alembic migration 0028_user_preferences
- Add UserPreference model to conftest.py for test schema
- Fix pre-existing conftest seed (Contact industry field removed in migration 0027)

Frontend:
- Create frontend/src/api/userPreferences.ts with React Query hooks
- Create frontend/src/hooks/useUserPreferences.ts syncing with uiStore
- Add i18n entries for de.json and en.json

Tests:
- 13 tests covering CRUD, tenant isolation, CSRF, unauthenticated access
- All tests passing

tests/conftest.py

@@ -35,6 +35,7 @@ from app.models.plugin import Plugin, PluginMigration  # noqa: F401
 from app.models.role import Role
 from app.models.tenant import Tenant
 from app.models.user import User, UserTenant
+from app.models.user_preference import UserPreference  # noqa: F401
 from app.models.workflow import Workflow, WorkflowInstance, WorkflowStepHistory  # noqa: F401
 from app.plugins.builtins.calendar import CalendarPlugin  # noqa: F401
 from app.plugins.builtins.calendar.models import (  # noqa: F401
@@ -270,16 +271,18 @@ async def seed_tenant_and_users(db: AsyncSession) -> dict[str, Any]:
     # Create a company in tenant A
     company_a = Contact(
         tenant_id=tenant_a.id,
+        type="company",
         name="Company Alpha",
-        industry="IT",
+        displayname="Company Alpha",
         created_by=admin_a.id,
         updated_by=admin_a.id,
     )
     # Create a company in tenant B
     company_b = Contact(
         tenant_id=tenant_b.id,
+        type="company",
         name="Company Beta",
-        industry="Finance",
+        displayname="Company Beta",
         created_by=admin_b.id,
         updated_by=admin_b.id,
     )