Implement notifications + supporting fixes

Adds the notifications system end-to-end (4 types, payload-versioned
JSONB, SSE-based live unread badge, /notifications page, mark-read API,
fan-out job for activity_published, daily 90-day retention purge).
Bell icon in the navbar with unread badge.

Side-findings from exercising the change:
- Add 6-digit magic code to registration (mirrors login UX, mobile
  paste-friendly), with `[Register Magic Link]` console line in dev so
  the code is reachable without a real email transport.
- Manual passkey/magic-link toggle on the register form (login already
  had it).
- Restrict ALPN to http/1.1 in HTTPS dev so React Router's
  singleFetchAction CSRF check (Origin vs. Host) passes — Node doesn't
  synthesize Host from h2's :authority. Plain HTTP dev unaffected.
- Followers/Following routes now use the locked-account rule from the
  profile route (owner + accepted followers see the list; others 404).
  Profile page renders the count chips as plain spans for viewers who
  can't see the lists, so private profiles don't surface dead links.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/journal/app/hooks/useUnreadNotifications.ts

@@ -0,0 +1,39 @@
+import { useEffect, useState } from "react";
+
+/**
+ * Subscribes to /api/events for live `notifications.unread` updates.
+ * Returns the live unread count, seeded with the loader-provided
+ * baseline so the badge renders correctly before the SSE handshake
+ * completes. Native EventSource handles reconnects with the
+ * server-suggested `retry:` interval.
+ */
+export function useUnreadNotifications(initialCount: number, signedIn: boolean): number {
+  const [count, setCount] = useState(initialCount);
+
+  // Keep the in-component count in sync if the loader-provided baseline
+  // changes (e.g., on navigation).
+  useEffect(() => {
+    setCount(initialCount);
+  }, [initialCount]);
+
+  useEffect(() => {
+    if (!signedIn) return;
+    if (typeof EventSource === "undefined") return;
+    const es = new EventSource("/api/events");
+    const onUnread = (e: MessageEvent) => {
+      try {
+        const parsed = JSON.parse(e.data) as { count: number };
+        if (typeof parsed.count === "number") setCount(parsed.count);
+      } catch {
+        // Malformed payload — ignore.
+      }
+    };
+    es.addEventListener("notifications.unread", onUnread as EventListener);
+    return () => {
+      es.removeEventListener("notifications.unread", onUnread as EventListener);
+      es.close();
+    };
+  }, [signedIn]);
+
+  return count;
+}