Implement notifications + supporting fixes

Adds the notifications system end-to-end (4 types, payload-versioned
JSONB, SSE-based live unread badge, /notifications page, mark-read API,
fan-out job for activity_published, daily 90-day retention purge).
Bell icon in the navbar with unread badge.

Side-findings from exercising the change:
- Add 6-digit magic code to registration (mirrors login UX, mobile
  paste-friendly), with `[Register Magic Link]` console line in dev so
  the code is reachable without a real email transport.
- Manual passkey/magic-link toggle on the register form (login already
  had it).
- Restrict ALPN to http/1.1 in HTTPS dev so React Router's
  singleFetchAction CSRF check (Origin vs. Host) passes — Node doesn't
  synthesize Host from h2's :authority. Plain HTTP dev unaffected.
- Followers/Following routes now use the locked-account rule from the
  profile route (owner + accepted followers see the list; others 404).
  Profile page renders the count chips as plain spans for viewers who
  can't see the lists, so private profiles don't surface dead links.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/journal/app/components/ClientDate.tsx

@@ -3,10 +3,14 @@ import { useLocale } from "./LocaleContext";
 /**
  * Renders a date formatted with the server-detected locale,
  * ensuring SSR and client output match (no hydration flicker).
+ * Pass `withTime` for surfaces where the hour/minute matter
+ * (e.g. notifications), keeping plain dates as the default.
  */
-export function ClientDate({ iso }: { iso: string }) {
+export function ClientDate({ iso, withTime = false }: { iso: string; withTime?: boolean }) {
   const locale = useLocale();
-  return (
-    <time dateTime={iso}>{new Date(iso).toLocaleDateString(locale)}</time>
-  );
+  const d = new Date(iso);
+  const text = withTime
+    ? d.toLocaleString(locale, { dateStyle: "short", timeStyle: "short" })
+    : d.toLocaleDateString(locale);
+  return <time dateTime={iso}>{text}</time>;
 }