Implement notifications + supporting fixes

Adds the notifications system end-to-end (4 types, payload-versioned
JSONB, SSE-based live unread badge, /notifications page, mark-read API,
fan-out job for activity_published, daily 90-day retention purge).
Bell icon in the navbar with unread badge.

Side-findings from exercising the change:
- Add 6-digit magic code to registration (mirrors login UX, mobile
  paste-friendly), with `[Register Magic Link]` console line in dev so
  the code is reachable without a real email transport.
- Manual passkey/magic-link toggle on the register form (login already
  had it).
- Restrict ALPN to http/1.1 in HTTPS dev so React Router's
  singleFetchAction CSRF check (Origin vs. Host) passes — Node doesn't
  synthesize Host from h2's :authority. Plain HTTP dev unaffected.
- Followers/Following routes now use the locked-account rule from the
  profile route (owner + accepted followers see the list; others 404).
  Profile page renders the count chips as plain spans for viewers who
  can't see the lists, so private profiles don't surface dead links.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/journal/vite.config.ts

@@ -29,5 +29,15 @@ export default defineConfig({
   server: {
     port: 3000,
     host: true,
+    // Force HTTP/1.1 over TLS in HTTPS dev. Vite v8 starts an
+    // `http2.createSecureServer({ allowHTTP1: true })` for any HTTPS
+    // config, so ALPN negotiates h2 by default. That breaks
+    // `useFetcher().Form` POSTs because React Router's CSRF check in
+    // `singleFetchAction` compares `Origin` against the `Host` header,
+    // which HTTP/2 replaces with `:authority` and Node doesn't
+    // synthesize back. Restricting ALPN to `http/1.1` keeps the Host
+    // header intact and lets fetcher form submissions through.
+    // Plain HTTP dev (the default) is unaffected.
+    https: process.env.HTTPS === "1" ? { ALPNProtocols: ["http/1.1"] } : undefined,
   },
 });