Update Reporting Preferences

Per-user reporting preferences (stored on User.reporting_preferences).

last_viewed maps a category (section) id → the dashboard id the user last viewed there, both as strings. Dumb storage: stale ids are tolerated and resolved away on the client, so no existence validation happens here.