Partially updates just the user's notificationsLastSeen timestamp,
leaving their email/push preferences untouched. A caller may only
update their own record: if {userId} is not the authenticated user's
id the request is rejected with 403.

Split out from the POST preferences endpoint above because this is
written far more often — once per notifications-UI open — than a
user's channel preferences change.

The write is an upsert, so it succeeds for a user who has no
notifications.preferences row yet (rows are otherwise seeded on first
subscription).