Full-replace the current user's reporting prefs.
Successful Response
Per-user reporting preferences (stored on User.reporting_preferences).
last_viewed maps a category (section) id → the dashboard id the user last viewed there, both as strings. Dumb storage: stale ids are tolerated and resolved away on the client, so no existence validation happens here.