Add timezone and notif_last_seen to user_preferences valid keys whitelist

Both keys were silently dropped on batch save (the for-loop just
continued on unknown keys). timezone is sent by saveSettings() and
notif_last_seen is written by the notifications mark-read endpoint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/user_preferences.php

@@ -30,9 +30,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         'rows_per_page',
         'default_status_filters',
         'table_density',
+        'timezone',
         'notifications_enabled',
         'sound_effects',
-        'toast_duration'
+        'toast_duration',
+        'notif_last_seen',
     ];
 
     // Support batch save: { preferences: { key: value, ... } }