feat(M2): Persönliche Dashboards — Tabelle, CRUD, Lazy-Seed, RLS (#360)

- dashboards-Tabelle (Layout JSONB, Tabs, is_default, partial unique name index)
- 6 CRUD-Endpoints /api/v1/dashboards, Owner-only (saved_views-Präzedenz), Audit
- Lazy Default-Seed aus MiniApp-Registry (permission-gefiltert, 12-Spalten-Flow)
- CORE_PERMISSIONS dashboard:read/write (fixt Phantom-Permission in dashboard.py)
- Migration 0144: RLS crm_api+crm_worker + konvergenter Fix der 3 Phase-L-Policies
- Tests: test_dashboards_backend.py 23/23 (TDD rot->grün); Regression 162/163

app/plugins/miniapp_registry.py

@@ -152,3 +152,20 @@ def reset_miniapp_registry() -> None:
     """Reset the singleton instance (useful for tests)."""
     global _registry
     _registry = None
+
+
+def user_permits(current_user: dict[str, Any], app: dict[str, Any]) -> bool:
+    """Check whether *current_user* may see/use the MiniApp *app*.
+
+    Empty permission = visible to everyone; otherwise fail-closed check
+    (system admins always pass). Shared by /api/v1/miniapps and the
+    personal dashboard seed (Phase M2) so both apply identical rules.
+    """
+    from app.core.permissions import check_permission
+
+    required = app.get("permission") or ""
+    if not required:
+        return True
+    if current_user.get("is_system_admin"):
+        return True
+    return check_permission(current_user, required)