feat: push selected events to a phone over ntfy

Adds a Notifications tab to Settings so an operator can pick which events
reach their phone, published to a single self-hosted ntfy topic.

The notifier subscribes to the realtime event hub the dashboard already
consumes, so every notifiable event keeps exactly one publisher. Inbound
media had no event, so `media.received` is added and published from the
existing durable `gotImage` gate in the chat service — one notification
per conversation, never repeated when the room re-syncs. It feeds the
in-app notification bell as well.

- Best-effort delivery: a rejecting or unreachable ntfy server is logged
  and never propagated into the path that produced the event.
- Events buffered before the notifier attaches are skipped, so a restart
  cannot replay a backlog to somebody's phone.
- Settings are applied field by field onto the live config object, so a
  save takes effect without a restart.
- The access token is environment-owned (NTFY_AUTH_TOKEN) like the other
  secrets: stripped before the settings record is written, never returned
  by the API, which reports only `hasAuthToken`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/testUtils.ts

@@ -93,6 +93,22 @@ export function getTestConfig(overrides?: Partial<Config>): Config {
       variants: [],
       ...overrides?.chatStrategies,
     },
+    pushNotifications: {
+      enabled: false,
+      serverUrl: 'https://ntfy.sh',
+      topic: '',
+      priority: 'default',
+      events: {
+        imageReceived: true,
+        replyReceived: false,
+        messageFailed: false,
+        botStopped: false,
+        rateLimited: false,
+        sessionExpired: true,
+        syncFailed: false,
+      },
+      ...overrides?.pushNotifications,
+    },
     web: {
       enabled: true,
       port: 3000,