feat(admin-api): expose notification_preferences as read-only

Resolve the earlier open question by mapping the profile-settings
domain's notification toggles to the existing notification_preferences
table (primary key user_id, no sensitive columns). Read-only, gated on
view_users, with a test covering read access and rejected writes.

apps/api/src/domains/admin/repository.ts

@@ -40,6 +40,7 @@ const resources: Record<string, ResourceRule> = {
   quiz_answers: { read: ['view_users', 'view_activity'] },
   sent_dares: { read: ['view_users', 'view_activity', 'view_chats'] },
   dare_messages: { read: ['view_chats', 'view_activity'] },
+  notification_preferences: { read: 'view_users', idColumn: 'user_id' },
 };
 
 function identifier(value: string): string {