fix: isolate payload-preferences by auth collection (#15425)

### What
Fixes preferences being accessible across different auth collections in
multi-auth setups.

### Why
The `preferenceAccess` function only checked user ID without verifying
which auth collection the user belonged to. In setups with multiple auth
collections using sequential IDs, this could allow unintended access to
preferences.

### How
Updated `preferenceAccess` to check both user ID and auth collection,
consistent with the existing operation handlers. Added tests to verify
proper isolation.