feat(M2): Persönliche Dashboards — Tabelle, CRUD, Lazy-Seed, RLS (#360)

- dashboards-Tabelle (Layout JSONB, Tabs, is_default, partial unique name index)
- 6 CRUD-Endpoints /api/v1/dashboards, Owner-only (saved_views-Präzedenz), Audit
- Lazy Default-Seed aus MiniApp-Registry (permission-gefiltert, 12-Spalten-Flow)
- CORE_PERMISSIONS dashboard:read/write (fixt Phantom-Permission in dashboard.py)
- Migration 0144: RLS crm_api+crm_worker + konvergenter Fix der 3 Phase-L-Policies
- Tests: test_dashboards_backend.py 23/23 (TDD rot->grün); Regression 162/163

docs/api-documentation.md

@@ -283,6 +283,19 @@ Generic CRUD for tenant-wide custom field definitions per entity type (W4b patte
 | GET | `/api/v1/system/dashboard` | Comprehensive system dashboard (admin-only). Returns: health, DB stats, Redis stats, worker stats, API stats, plugin stats, storage stats. |
 | GET | `/api/v1/system/alerts` | Active system alerts (admin-only). Returns alerts from Communication-System. |
 
+### dashboards (6 endpoints)
+
+Personal per-user dashboards (Phase M2). Owner-only: every query is scoped to tenant + current user; foreign dashboards answer 404. First GET lazily seeds a default dashboard from the MiniApp registry (permission-filtered, registry order, 12-column flow). Requires `dashboard:read` / `dashboard:write` (core permissions).
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/v1/dashboards` | List own dashboards (lazy default seed on first call). |
+| POST | `/api/v1/dashboards` | Create dashboard (409 duplicate name; first one becomes default; starts with one empty tab). |
+| GET | `/api/v1/dashboards/{id}` | Get one dashboard (owner-only, 404 foreign). |
+| PUT | `/api/v1/dashboards/{id}` | Update name/layout (layout validated -> 422 on bad grid bounds). |
+| DELETE | `/api/v1/dashboards/{id}` | Soft-delete (deleting the default promotes the next one). |
+| POST | `/api/v1/dashboards/{id}/set-default` | Mark as the user's default (exactly one). |
+
 ---
 
 ## Plugin Routes