Where are cellular data preferences stored in iOS?

In Settings → Cellular (Mobile in UK), settings can be changed regarding mobile data, including per-app switches for all installed apps to enable or disable mobile data.

Where are these preferences stored?

I've looked in /var/mobile/Library/Preferences, but there doesn't seem to be any preferences relating to this. I've searched through the plists for various strings including app names and IDs from the list of per-app settings, but not found anything.

The directory you're looking for happens to be /var/wireless/Library/Preferences. This is where the Settings > Cellular settings are stored. The per-application settings are stored in the database /var/wireless/Library/Databases/CellularUsage.db. If you want to add a setting manually, you'll need to add an entry for the application in two tables. The first is bundle_uuid, and you'll need to set the bundle_id field to the friendly bundle name (such as com.developersbliss.Helicopter), and then the macho_uuid field to its UUID (such as DD314675-0AA8-8A84-DB2BB966BAD8) (Repeat this step for each UUID that the application has. In my particular example, there are two UUIDs. Just add another entry to the table for each UUID, but with the bundle_id set the same as before, and with the macho_uuid set to the next UUID the application has.). Then you'll need to make an entry in the bundle_info table with the bundle_id field set to the friendly bundle name used in the bundle_uuid table, and then the flags field set to 0. This will make that particular application be restricted from using cellular data. To enable the application to use cellular data again, just set its flags field in the bundle_info table to 1. Any application not found in this database is assumed to be allowed to use cellular data.