Add customizable home dashboard with per-user pinned apps

- Users can pin/unpin any available service on their home page via a
  Customize mode; preferences persisted via PATCH /api/users/me/preferences
- Time-aware greeting renders the user's display name through React JSX
  (HTML-escaped by design — no dangerouslySetInnerHTML used)
- Added dashboard_app_ids JSON column to users table (migration c7e8f9a0b1d2)
- /settings now routes to a placeholder page

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/STATUS.md

@@ -25,6 +25,8 @@ JWT signing uses a 4096-bit RSA key pair (`RS256`). Keys are generated by `scrip
 | Method | Path | Description |
 |--------|------|-------------|
 | `GET` | `/api/users/me` | Current user info |
+| `GET` | `/api/users/me/preferences` | User's dashboard preferences (`app_ids` list) |
+| `PATCH` | `/api/users/me/preferences` | Update pinned app IDs (max 50; validated as safe slugs) |
 
 ### Profile (`/api/profile`)
 
@@ -84,7 +86,7 @@ All `/api/documents/*` and `/api/documents/categories/*` requests are transparen
 
 | Model | Table | Notes |
 |-------|-------|-------|
-| `User` | `users` | email, hashed_password, role (`user`\|`admin`), is_active |
+| `User` | `users` | email, hashed_password, role (`user`\|`admin`), is_active, dashboard_app_ids (JSON) |
 | `Profile` | `profiles` | one-to-one with User; full_name, phone, etc. |
 | `Group` | `groups` | name (unique), description, created_at |
 | `GroupMembership` | `group_memberships` | group_id + user_id (unique pair); joined_at |