feat(notifications): persistent notification center

- notifications table (goose migration) + sqlc queries; list with unread
  count, mark-one, mark-all endpoints under /notifications.
- Deployment success/failure now writes a notification row for the owner
  (insertUserNotification — best-effort, never breaks the deploy flow).
- Shell bell reads the real persisted feed: unread badge, click-to-read,
  mark-all, 30s polling. Replaces the transient builds+audit derivation.

Verified e2e: migration applies clean, list/read/read-all round-trips.

Authored By: TDvorak <[email protected]>

app/backend/internal/database/sqlcdb/models.go

@@ -137,6 +137,18 @@ type NodeAgent struct {
 	Metadata      pqtype.NullRawMessage `json:"metadata"`
 }
 
+type Notification struct {
+	ID           uuid.UUID      `json:"id"`
+	UserID       uuid.UUID      `json:"user_id"`
+	Kind         string         `json:"kind"`
+	Title        string         `json:"title"`
+	Body         sql.NullString `json:"body"`
+	ResourceType sql.NullString `json:"resource_type"`
+	ResourceID   sql.NullString `json:"resource_id"`
+	ReadAt       sql.NullTime   `json:"read_at"`
+	CreatedAt    sql.NullTime   `json:"created_at"`
+}
+
 type Project struct {
 	ID          uuid.UUID      `json:"id"`
 	Name        string         `json:"name"`