feat(dashboard): owner-only GET/PUT /api/dashboard/layout

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/api/routes/dashboard.js

@@ -0,0 +1,26 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { validate } from '../validate.js';
+import { asyncWrap } from '../errors.js';
+import { requireOwner } from '../cap.js';
+import * as repo from '../../db/repos/dashboard_layout.js';
+
+export const router = Router();
+router.use(requireOwner);
+
+const layoutSchema = z.object({
+  card_order: z.array(z.string()).default([]),
+  hidden: z.array(z.string()).default([]),
+  sizes: z.record(z.enum(['s', 'm', 'l'])).default({})
+});
+
+router.get('/layout', asyncWrap(async (_req, res) => {
+  res.json(await repo.get());
+}));
+
+router.put('/layout',
+  validate({ body: layoutSchema }),
+  asyncWrap(async (req, res) => {
+    res.json(await repo.put(req.body));
+  })
+);