feat: access control UI in Settings + sidebar drag-and-drop reordering

- Add Access Control card in Settings (admin-only): role defaults display, user overrides CRUD
- Add sidebar drag-and-drop reordering with per-user persistence in rbac.json
- Backend: GET/PUT /api/auth/preferences endpoints, sidebar order helpers in rbac.py
- Frontend: HTML5 drag API with grip handles, smart order merge, debounced save
- Preserve sidebar_order when updating page overrides

dashboard/backend/rbac.py

@@ -61,6 +61,18 @@ def get_pages(username: str, role: str) -> list | str:
     return rbac.get("role_defaults", {}).get(role, {}).get("pages", [])
 
 
+def get_sidebar_order(username: str) -> dict | None:
+    rbac = load_rbac()
+    overrides = rbac.get("user_overrides", {})
+    return overrides.get(username, {}).get("sidebar_order")
+
+
+def save_sidebar_order(username: str, order: dict):
+    rbac = load_rbac()
+    rbac.setdefault("user_overrides", {}).setdefault(username, {})["sidebar_order"] = order
+    save_rbac(rbac)
+
+
 def has_page_access(user: User, page: str) -> bool:
     if user.pages == "*":
         return True