Fully replaces the user's stored email/push notification opt-ins. A
caller may only update their own record: if {userId} is not the
authenticated user's id the request is rejected with 403. This
endpoint never changes notificationsLastSeen — use
PATCH /notification/user/{userId} for that.

The write is an upsert, so it succeeds for a user who has no
notifications.preferences row yet (rows are otherwise seeded on first
subscription).