feat(M2): Persönliche Dashboards — Tabelle, CRUD, Lazy-Seed, RLS (#360)

- dashboards-Tabelle (Layout JSONB, Tabs, is_default, partial unique name index)
- 6 CRUD-Endpoints /api/v1/dashboards, Owner-only (saved_views-Präzedenz), Audit
- Lazy Default-Seed aus MiniApp-Registry (permission-gefiltert, 12-Spalten-Flow)
- CORE_PERMISSIONS dashboard:read/write (fixt Phantom-Permission in dashboard.py)
- Migration 0144: RLS crm_api+crm_worker + konvergenter Fix der 3 Phase-L-Policies
- Tests: test_dashboards_backend.py 23/23 (TDD rot->grün); Regression 162/163

app/routes/miniapps.py

@@ -9,21 +9,14 @@ from __future__ import annotations
 
 from fastapi import APIRouter, Depends, HTTPException
 
-from app.core.permissions import check_permission
 from app.deps import get_current_user
-from app.plugins.miniapp_registry import get_miniapp_registry
+from app.plugins.miniapp_registry import get_miniapp_registry, user_permits
 
 router = APIRouter(prefix="/api/v1/miniapps", tags=["miniapps"])
 
-
-def _user_permits(current_user: dict, app: dict) -> bool:
-    """Empty permission = visible to everyone; otherwise fail-closed check."""
-    required = app.get("permission") or ""
-    if not required:
-        return True
-    if current_user.get("is_system_admin"):
-        return True
-    return check_permission(current_user, required)
+# Backward-compatible alias (the canonical helper lives in the registry
+# module since Phase M2 — shared with the personal dashboard seed).
+_user_permits = user_permits
 
 
 @router.get("")