feat: add user preferences and saved stations API endpoints

Adds authenticated endpoints for reading/updating fuel type preferences and managing saved stations, backed by new migrations and a SavedStation model.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/Feature/Api/UserControllerTest.php

@@ -0,0 +1,67 @@
+<?php
+
+use App\Models\User;
+use Laravel\Sanctum\Sanctum;
+
+it('returns user preferences for authenticated user', function (): void {
+    $user = User::factory()->create(['preferred_fuel_type' => 'diesel']);
+    Sanctum::actingAs($user);
+
+    $this->getJson('/api/user/preferences')
+        ->assertOk()
+        ->assertJsonFragment(['preferred_fuel_type' => 'diesel']);
+});
+
+it('updates user preferences', function (): void {
+    $user = User::factory()->create(['preferred_fuel_type' => 'petrol']);
+    Sanctum::actingAs($user);
+
+    $this->putJson('/api/user/preferences', ['preferred_fuel_type' => 'diesel'])
+        ->assertOk()
+        ->assertJsonFragment(['preferred_fuel_type' => 'diesel']);
+
+    expect($user->fresh()->preferred_fuel_type)->toBe('diesel');
+});
+
+it('rejects invalid fuel type in preferences update', function (): void {
+    $user = User::factory()->create();
+    Sanctum::actingAs($user);
+
+    $this->putJson('/api/user/preferences', ['preferred_fuel_type' => 'aviation_fuel'])
+        ->assertUnprocessable();
+});
+
+it('returns saved stations for authenticated user', function (): void {
+    $user = User::factory()->create();
+    Sanctum::actingAs($user);
+
+    $this->getJson('/api/user/saved-stations')
+        ->assertOk()
+        ->assertJsonStructure(['data']);
+});
+
+it('saves a station', function (): void {
+    $user = User::factory()->create();
+    Sanctum::actingAs($user);
+
+    $this->postJson('/api/user/saved-stations', ['station_id' => 'abc123'])
+        ->assertCreated();
+
+    expect($user->savedStations()->where('station_id', 'abc123')->exists())->toBeTrue();
+});
+
+it('removes a saved station', function (): void {
+    $user = User::factory()->create();
+    $user->savedStations()->create(['station_id' => 'abc123']);
+    Sanctum::actingAs($user);
+
+    $this->deleteJson('/api/user/saved-stations/abc123')
+        ->assertNoContent();
+
+    expect($user->savedStations()->where('station_id', 'abc123')->exists())->toBeFalse();
+});
+
+it('rejects unauthenticated requests to user endpoints', function (): void {
+    $this->getJson('/api/user/preferences')->assertUnauthorized();
+    $this->getJson('/api/user/saved-stations')->assertUnauthorized();
+});