feat(notifications): persistent notification center

- notifications table (goose migration) + sqlc queries; list with unread
  count, mark-one, mark-all endpoints under /notifications.
- Deployment success/failure now writes a notification row for the owner
  (insertUserNotification — best-effort, never breaks the deploy flow).
- Shell bell reads the real persisted feed: unread badge, click-to-read,
  mark-all, 30s polling. Replaces the transient builds+audit derivation.

Verified e2e: migration applies clean, list/read/read-all round-trips.

Authored By: TDvorak <[email protected]>

ROADMAP.md

@@ -315,8 +315,13 @@ All of these have working APIs and no UI. Cheapest feature wins in the repo.
   - [ ] Note: APwhy's own auth/RBAC/deploy/database endpoints are *not*
         ported — Better Auth owns identity, Containr owns deployments and
         databases natively.
-- [ ] **Notifications depth**: notification center persistence (read/unread),
-      not just a transient bell feed.
+- [x] **Notifications depth**: `notifications` table + `GET /notifications`,
+      `POST /notifications/:id/read`, `POST /notifications/read-all`. Bell
+      feed now reads real persisted rows with unread badge + mark-read.
+      Producer wired: deployment success/failure writes a notification.
+      Verified e2e: list, unread count, mark-one, mark-all. Further producers
+      (backup completion, agent offline, upgrade available) can reuse
+      `insertUserNotification`.
 - [x] **GitHub App install surfacing**: Settings → Git Providers shows an
       "Install GitHub App" action that opens `install_url`, and handles the
       `?installation_id=` return by calling `POST /git/github-app/connect`.