feat(notifications): persistent notification center

- notifications table (goose migration) + sqlc queries; list with unread
  count, mark-one, mark-all endpoints under /notifications.
- Deployment success/failure now writes a notification row for the owner
  (insertUserNotification — best-effort, never breaks the deploy flow).
- Shell bell reads the real persisted feed: unread badge, click-to-read,
  mark-all, 30s polling. Replaces the transient builds+audit derivation.

Verified e2e: migration applies clean, list/read/read-all round-trips.

Authored By: TDvorak <[email protected]>

app/backend/sqlc/queries/notifications.sql

@@ -0,0 +1,19 @@
+-- name: CreateNotification :exec
+INSERT INTO notifications (id, user_id, kind, title, body, resource_type, resource_id, created_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8);
+
+-- name: ListNotificationsByUser :many
+SELECT id, user_id, kind, title, body, resource_type, resource_id, read_at, created_at
+FROM notifications
+WHERE user_id = $1
+ORDER BY created_at DESC
+LIMIT $2;
+
+-- name: CountUnreadNotificationsByUser :one
+SELECT COUNT(*) FROM notifications WHERE user_id = $1 AND read_at IS NULL;
+
+-- name: MarkNotificationReadByIDAndUser :exec
+UPDATE notifications SET read_at = $3 WHERE id = $1 AND user_id = $2 AND read_at IS NULL;
+
+-- name: MarkAllNotificationsReadByUser :exec
+UPDATE notifications SET read_at = $2 WHERE user_id = $1 AND read_at IS NULL;

app/backend/sqlc/schema.sql

@@ -183,3 +183,15 @@ CREATE TABLE agent_heartbeats (
     version VARCHAR(50) NOT NULL DEFAULT '',
     created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
+
+CREATE TABLE notifications (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    kind VARCHAR(50) NOT NULL,
+    title VARCHAR(255) NOT NULL,
+    body TEXT,
+    resource_type VARCHAR(50),
+    resource_id VARCHAR(255),
+    read_at TIMESTAMP WITH TIME ZONE,
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+);