feat(notify): bundled notifications, task watchers, daily summary

- Per-user routing (own mail / own Discord webhook) for task alarms
  (sent at once), shares, completed shared tasks and watched tasks;
  settings as JSON on the user (GET /auth/me, PATCH /auth/settings).
- Everything but alarms is queued and sent as one message per user
  after NOTIFY_DIGEST_MINUTES (default 5); mails now multipart with an
  HTML version, Discord as one embed. Three failed attempts drop it.
- Own changes never notify the actor, except on watched tasks when
  asked for; "paused" stops everything including alarms.
- Task watchers: POST/DELETE /tasks/{id}/watch, isWatching on tasks.
- Daily summary at a chosen time: overdue, today, tomorrow, plus the
  count of the next 7 days; nothing due, nothing sent.
- Migration 7; jobs do not run in the demo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/alarms.go

@@ -13,6 +13,11 @@ import (
 // --- MULTI-CHANNEL ALARM DISPATCHER (EMAIL, DISCORD, CUSTOM WEBHOOK) ---
 
 func (s *Server) sendEmailNotification(toEmail, subject, bodyText string) error {
+	return s.sendEmailHTML(toEmail, subject, bodyText, "")
+}
+
+// sendEmailHTML sends text plus an optional HTML version (multipart/alternative).
+func (s *Server) sendEmailHTML(toEmail, subject, bodyText, html string) error {
 	if s.cfg.DemoMode {
 		return errDemoOutgoing
 	}
@@ -20,7 +25,7 @@ func (s *Server) sendEmailNotification(toEmail, subject, bodyText string) error
 	if err != nil {
 		return err
 	}
-	if err := sendMail(cfg, toEmail, subject, bodyText); err != nil {
+	if err := sendMail(cfg, toEmail, subject, bodyText, html); err != nil {
 		step := ""
 		if se, ok := err.(*smtpStepError); ok {
 			step = se.Step
@@ -123,6 +128,27 @@ func (s *Server) startAlarmTicker() {
 			if !alarmDue(a.DueDate, a.NotifyBeforeMinutes, now) {
 				continue
 			}
+			// Channels come from the notification settings (row "due"); a pause holds the alarm back
+			set := s.store.NotificationSettingsOf(a.UserID)
+			if set.Paused {
+				continue
+			}
+			channels := []string{}
+			if set.Events.Due.Email {
+				channels = append(channels, "email")
+			}
+			if set.Events.Due.Discord {
+				channels = append(channels, "discord")
+			}
+			for _, ch := range a.AlarmChannels {
+				if ch == "webhook" {
+					channels = append(channels, "webhook")
+				}
+			}
+			if a.AlarmEmail == "" {
+				a.AlarmEmail = a.UserEmail
+			}
+			a.AlarmChannels = channels
 			if len(a.AlarmChannels) == 0 {
 				continue
 			}