feat: access control UI in Settings + sidebar drag-and-drop reordering

- Add Access Control card in Settings (admin-only): role defaults display, user overrides CRUD
- Add sidebar drag-and-drop reordering with per-user persistence in rbac.json
- Backend: GET/PUT /api/auth/preferences endpoints, sidebar order helpers in rbac.py
- Frontend: HTML5 drag API with grip handles, smart order merge, debounced save
- Preserve sidebar_order when updating page overrides

dashboard/frontend/src/lib/api.js

@@ -130,3 +130,15 @@ export function login(creds) {
 export function checkAuth() {
   return request("/auth/me");
 }
+
+export function getPreferences() {
+  return get("/auth/preferences");
+}
+
+export function savePreferences(data) {
+  return request("/auth/preferences", { method: "PUT", json: data });
+}
+
+export function put(path, data) {
+  return request(path, { method: "PUT", json: data });
+}