feat(notifications): persistent notification center

- notifications table (goose migration) + sqlc queries; list with unread
  count, mark-one, mark-all endpoints under /notifications.
- Deployment success/failure now writes a notification row for the owner
  (insertUserNotification — best-effort, never breaks the deploy flow).
- Shell bell reads the real persisted feed: unread badge, click-to-read,
  mark-all, 30s polling. Replaces the transient builds+audit derivation.

Verified e2e: migration applies clean, list/read/read-all round-trips.

Authored By: TDvorak <[email protected]>

app/backend/sqlc/queries/notifications.sql

@@ -0,0 +1,19 @@
+-- name: CreateNotification :exec
+INSERT INTO notifications (id, user_id, kind, title, body, resource_type, resource_id, created_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8);
+
+-- name: ListNotificationsByUser :many
+SELECT id, user_id, kind, title, body, resource_type, resource_id, read_at, created_at
+FROM notifications
+WHERE user_id = $1
+ORDER BY created_at DESC
+LIMIT $2;
+
+-- name: CountUnreadNotificationsByUser :one
+SELECT COUNT(*) FROM notifications WHERE user_id = $1 AND read_at IS NULL;
+
+-- name: MarkNotificationReadByIDAndUser :exec
+UPDATE notifications SET read_at = $3 WHERE id = $1 AND user_id = $2 AND read_at IS NULL;
+
+-- name: MarkAllNotificationsReadByUser :exec
+UPDATE notifications SET read_at = $2 WHERE user_id = $1 AND read_at IS NULL;