feat(notifications): add owner-scoped in-app inbox

[fredericklamar342-prog]

Summary

• Add the owner-linked Notification model, typed payload validation, provider-agnostic channel adapter registry, and authenticated inbox endpoints with unread filtering, count, read-all, and keyset pagination.
• Ensure every notification query is scoped to the authenticated user; payload schemas accept opaque record IDs only and exclude clinical detail.
• Persist in-app notifications before external adapters run and isolate adapter failures from the write.
• Add the Prisma migration and update architecture, API, and Phase 6 roadmap documentation. Provider integrations remain deferred to issue [Phase 6] ADR: pick notification provider (email/SMS) #17.

Tests

• npm run audit:prod — passed (policy-tolerated existing Axios advisories only).
• npm run typecheck — passed.
• npm test — passed (93 tests).
• npm run test:integration — passed (161 tests, including 4 new notification inbox cases).
• npm run build — passed.
• npm run test:all — 254 tests passed and 3 skipped, but the optional live-testnet payments suite fails in its setup before skips are applied because its Prisma client uses the default test database URL. CI runs the separate unit/integration commands above and excludes tests/testnet-integration/.

No new provider configuration is required. The notification migration must be applied with the normal Prisma migration deployment.

Closes #93

[drips-wave]

@fredericklamar342-prog Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[afeezorobsco-cyber]

@fredericklamar342-prog Thanks for the PR. It can't be merged yet. To unblock it:

Merge conflicts: this branch conflicts with main. Please rebase onto the latest main (git fetch upstream && git rebase upstream/main), resolve the conflicts (often ROADMAP.md, ARCHITECTURE*.md or prisma/schema.prisma), and force-push.

Push to this same branch and CI will re-run. Once it's green and conflict-free, it'll be reviewed for merge.