Add durable notification domain service

[Obiajulu-gif]

What changed

• added typed, versioned notification events and deterministic templates
• added per-user preferences with mandatory operational categories
• added per-channel idempotency, durable scheduled email delivery, exponential retries, dead-letter state, and provider attempt history
• added scoped expiring preference tokens, safe application URL validation, and PII/secret redaction
• migrated KYC notifications away from direct in-action email/in-app sends
• added protected worker and admin delivery-history endpoints
• documented taxonomy, preference matrix, template rules, and lifecycle

Why

Direct notification sends cannot be retried safely and can create duplicate or contradictory messages. This introduces a domain-event-driven delivery boundary with durable channel state.

Validation

• npm test — 14 tests passed
• scoped ESLint — passed
• notification-specific TypeScript check — passed
• git diff --check — passed

The repository-wide typecheck still reports existing unrelated admin/UI typing errors. The production build entered the existing SWC WASM fallback on Windows.

Closes #92