feat: user preferences sync — server-side storage, whiteboard defaults, dashboard widget visibility

- New table `user_preferences` (user_id PK, JSON blob, updated_at)
- GET/PATCH/DELETE /api/preferences with deep-merge UPSERT
- LS.prefs singleton in api.js: dot-notation get/set, debounced flush (1.5s), server sync
- classroom.html: load wb.color/width/lineStyle/theme from prefs on init; save on change
- dashboard.html: widget configurator panel (gear button) — toggle visibility per-user, persisted server-side

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

js/api.js

@@ -641,6 +641,60 @@ async function biochemGetSaved()         { return req('GET', '/biochem/saved');
 async function biochemSave(atoms,bonds,name){ return req('POST','/biochem/saved',{atoms,bonds,name}); }
 async function biochemDeleteSaved(id)    { return req('DELETE',`/biochem/saved/${id}`); }
 
+/* ── LS.prefs — server-synced user preferences ──────────────────────────
+   Keys use dot-notation: 'wb.color', 'dashboard.hidden', etc.
+   Writes are debounced (1.5 s) before flushing to /api/preferences.
+   ─────────────────────────────────────────────────────────────────────── */
+const _prefsCache = {};
+let _prefsDirty    = false;
+let _prefsTimer    = null;
+
+async function _prefsLoad() {
+    if (!isLoggedIn()) return;
+    try {
+        const data = await apiFetch('/api/preferences', { method: 'GET' });
+        Object.assign(_prefsCache, data);
+    } catch (e) {}
+}
+
+function _prefsFlush() {
+    if (!_prefsDirty) return;
+    _prefsDirty = false;
+    if (!isLoggedIn()) return;
+    apiFetch('/api/preferences', {
+        method: 'PATCH',
+        body: JSON.stringify(_prefsCache),
+    }).catch(() => {});
+}
+
+const lsPrefs = {
+    get(key, def) {
+        const parts = key.split('.');
+        let cur = _prefsCache;
+        for (const k of parts) {
+            if (cur === undefined || cur === null) return def;
+            cur = cur[k];
+        }
+        return cur !== undefined ? cur : def;
+    },
+    set(key, value) {
+        const parts = key.split('.');
+        let cur = _prefsCache;
+        for (let i = 0; i < parts.length - 1; i++) {
+            if (!cur[parts[i]] || typeof cur[parts[i]] !== 'object' || Array.isArray(cur[parts[i]])) {
+                cur[parts[i]] = {};
+            }
+            cur = cur[parts[i]];
+        }
+        cur[parts[parts.length - 1]] = value;
+        _prefsDirty = true;
+        clearTimeout(_prefsTimer);
+        _prefsTimer = setTimeout(_prefsFlush, 1500);
+    },
+    async init() { await _prefsLoad(); },
+    flush()      { clearTimeout(_prefsTimer); _prefsFlush(); },
+};
+
 window.LS = {
   getToken, setToken, removeToken,
   getUser, setUser, removeUser,
@@ -698,6 +752,7 @@ window.LS = {
   biochemGetElements, biochemGetMolecules, biochemGetMolecule, biochemValidate,
   biochemGetReactions, biochemGetChallenges, biochemSolveChallenge,
   biochemGetSaved, biochemSave, biochemDeleteSaved,
+  prefs: lsPrefs,
 };
 
 /* ═══════════════════════════════════════════════════════════════════════