[WKP-81] Persist user preferences across devices

[SteadfastKnight]

Summary

Audit found 9 user preferences stored in localStorage only (per-device, per-browser). This PR moves all of them to backend-backed storage with localStorage cache, so they sync across devices and browsers on login. Mirrors the existing UserDictionaryService pattern.

Three groups, three tables:

Group	Table	Endpoint
Personalisation (theme, palette, layout)	user_preferences	GET/PATCH /api/preferences
List sort orders (documents, book-view, translation, extraction, page-linking)	user_view_states	GET/PATCH /api/view-states
Spell-check ignored words	user_ignored_words	GET /api/ignored-words, POST, DELETE/{id}

Design choices

• GET returns {data: null} (or empty list) when no row exists — no firstOrCreate. Prevents Device B from clobbering Device A's settings with defaults on first load.
• PATCH (not PUT) for partial updates — quick toggles don't clobber sibling fields.
• localStorage stays as a cache so the FOUC-prevention inline script in index.html keeps working.
• Cross-tab sync via window.addEventListener('storage', ...).
• No localStorage→server migration: app not yet launched; devs re-pick once after deploy.
• Don't clear localStorage on logout — keeps login page themed.

Bonus fix: vitest tests on Node 22+

Found and fixed an unrelated test infrastructure bug: Node 22+ defines localStorage on globalThis as an experimental stub that resolves to undefined. Vitest's jsdom env's populateGlobal skips overriding existing globals not in its KEYS list, so Node's broken stub shadowed jsdom's working localStorage — making 218 tests fail. Added a tiny polyfill (src/test-setup/local-storage.ts) that installs methods on Storage.prototype so existing vi.spyOn patterns keep working. Skipped on Node <22 where jsdom's storage already works.

Test plan

• php artisan migrate then run frontend (1060 specs) + backend (40 new feature tests) — all green.
• Log in Browser A → change theme/palette/layout, sort a list, ignore a word in the editor.
• Open Browser B (different profile/incognito) → log in same account → confirm all settings carry over.
• Log out of Browser A → login page stays themed.
• Open two tabs in Browser A → change palette in tab 1 → tab 2 picks it up (storage event).
• Devtools offline → toggle theme → signal updates, localStorage updated; PATCH retries silently fail.
• Fresh browser (no auth) → set theme as guest → log in to account with no server prefs → guest values preserved (server null response); change theme → server now has a row.
• Same as above but log in to account with existing server prefs → guest values silently replaced by server.

🤖 Generated with Claude Code