Implement notifications + supporting fixes

Adds the notifications system end-to-end (4 types, payload-versioned
JSONB, SSE-based live unread badge, /notifications page, mark-read API,
fan-out job for activity_published, daily 90-day retention purge).
Bell icon in the navbar with unread badge.

Side-findings from exercising the change:
- Add 6-digit magic code to registration (mirrors login UX, mobile
  paste-friendly), with `[Register Magic Link]` console line in dev so
  the code is reachable without a real email transport.
- Manual passkey/magic-link toggle on the register form (login already
  had it).
- Restrict ALPN to http/1.1 in HTTPS dev so React Router's
  singleFetchAction CSRF check (Origin vs. Host) passes — Node doesn't
  synthesize Host from h2's :authority. Plain HTTP dev unaffected.
- Followers/Following routes now use the locked-account rule from the
  profile route (owner + accepted followers see the list; others 404).
  Profile page renders the count chips as plain spans for viewers who
  can't see the lists, so private profiles don't surface dead links.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/db/src/schema/journal.ts

@@ -1,3 +1,4 @@
+import { sql } from "drizzle-orm";
 import {
   pgSchema,
   text,
@@ -231,3 +232,42 @@ export const follows = journalSchema.table("follows", {
   followedActorIdx: index("follows_followed_actor_idx").on(t.followedActorIri),
   followedUserIdx: index("follows_followed_user_idx").on(t.followedUserId),
 }));
+
+// Notifications. Each row is a single event the recipient should be
+// informed about. v1 types: follow_request_received, follow_request_approved,
+// follow_received, activity_published. The `payload` JSONB snapshots the
+// renderer-friendly fields at create time so future mobile push / email
+// renderers can render without a fresh DB lookup; `payloadVersion` lets
+// us evolve per-type payload shapes additively. See spec: notifications.
+export type NotificationType =
+  | "follow_request_received"
+  | "follow_request_approved"
+  | "follow_received"
+  | "activity_published";
+
+export const notifications = journalSchema.table("notifications", {
+  id: text("id").primaryKey(),
+  recipientUserId: text("recipient_user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  type: text("type").$type<NotificationType>().notNull(),
+  actorUserId: text("actor_user_id").references(() => users.id, { onDelete: "set null" }),
+  subjectId: text("subject_id"),
+  payload: jsonb("payload").$type<Record<string, unknown>>(),
+  payloadVersion: integer("payload_version").notNull().default(1),
+  readAt: timestamp("read_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+}, (t) => ({
+  // Listing query: every load of /notifications joins on recipient + sorts by created_at desc.
+  recipientCreatedIdx: index("notifications_recipient_created_idx").on(t.recipientUserId, t.createdAt.desc()),
+  // Hot path: countUnread for the navbar badge runs on every page nav.
+  // Partial index keeps it tiny.
+  recipientUnreadIdx: index("notifications_recipient_unread_idx")
+    .on(t.recipientUserId, t.createdAt.desc())
+    .where(sql`${t.readAt} IS NULL`),
+  // Fan-out idempotency: prevent double-insert of activity_published rows
+  // when a pg-boss job retries. Soft uniqueness across (recipient, type, subject).
+  recipientTypeSubjectUnique: uniqueIndex("notifications_recipient_type_subject_unique")
+    .on(t.recipientUserId, t.type, t.subjectId)
+    .where(sql`${t.subjectId} IS NOT NULL`),
+}));

packages/i18n/src/locales/de.ts

@@ -241,6 +241,18 @@ export default {
         bodyAnon: "Melde dich an und sende eine Folge-Anfrage, um die öffentlichen Routen und Aktivitäten zu sehen.",
       },
     },
+    notifications: {
+      title: "Benachrichtigungen",
+      empty: "Noch keine Benachrichtigungen.",
+      markAllRead: "Alle als gelesen markieren",
+      someone: "Jemand",
+      summary: {
+        followRequestReceived: "{{name}} möchte dir folgen",
+        followReceived: "{{name}} folgt dir jetzt",
+        followRequestApproved: "{{name}} hat deine Folge-Anfrage akzeptiert",
+        activityPublished: "{{owner}} hat „{{activity}}“ gepostet",
+      },
+    },
     social: {
       follow: "Folgen",
       unfollow: "Entfolgen",

packages/i18n/src/locales/en.ts

@@ -241,6 +241,18 @@ export default {
         bodyAnon: "Sign in and request to follow them to see their public routes and activities.",
       },
     },
+    notifications: {
+      title: "Notifications",
+      empty: "No notifications yet.",
+      markAllRead: "Mark all read",
+      someone: "Someone",
+      summary: {
+        followRequestReceived: "{{name}} requested to follow you",
+        followReceived: "{{name}} started following you",
+        followRequestApproved: "{{name}} accepted your follow request",
+        activityPublished: "{{owner}} posted “{{activity}}”",
+      },
+    },
     social: {
       follow: "Follow",
       unfollow: "Unfollow",