feat: push selected events to a phone over ntfy

Adds a Notifications tab to Settings so an operator can pick which events
reach their phone, published to a single self-hosted ntfy topic.

The notifier subscribes to the realtime event hub the dashboard already
consumes, so every notifiable event keeps exactly one publisher. Inbound
media had no event, so `media.received` is added and published from the
existing durable `gotImage` gate in the chat service — one notification
per conversation, never repeated when the room re-syncs. It feeds the
in-app notification bell as well.

- Best-effort delivery: a rejecting or unreachable ntfy server is logged
  and never propagated into the path that produced the event.
- Events buffered before the notifier attaches are skipped, so a restart
  cannot replay a backlog to somebody's phone.
- Settings are applied field by field onto the live config object, so a
  save takes effect without a restart.
- The access token is environment-owned (NTFY_AUTH_TOKEN) like the other
  secrets: stripped before the settings record is written, never returned
  by the API, which reports only `hasAuthToken`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/api.md

@@ -103,6 +103,9 @@ an administrator credential.
 | `GET` | `/api/outreach` | Get active outreach candidates and funnel stages | read | no |
 | `GET` | `/api/config` | Get non-secret application configuration | read | no |
 | `PUT` | `/api/config` | Update application configuration | admin | yes |
+| `GET` | `/api/push-notifications` | Get push notification settings | read | no |
+| `PUT` | `/api/push-notifications` | Update push notification settings | admin | yes |
+| `POST` | `/api/push-notifications/test` | Send a test push notification | admin | yes |
 | `GET` | `/api/login/status` | Get Reddit session state | read | no |
 | `POST` | `/api/login/session-import` | Import Reddit and Matrix credentials | admin | yes |
 | `GET` | `/api/accounts` | List Reddit accounts | read | no |