feat(notify): bundled notifications, task watchers, daily summary

- Per-user routing (own mail / own Discord webhook) for task alarms
  (sent at once), shares, completed shared tasks and watched tasks;
  settings as JSON on the user (GET /auth/me, PATCH /auth/settings).
- Everything but alarms is queued and sent as one message per user
  after NOTIFY_DIGEST_MINUTES (default 5); mails now multipart with an
  HTML version, Discord as one embed. Three failed attempts drop it.
- Own changes never notify the actor, except on watched tasks when
  asked for; "paused" stops everything including alarms.
- Task watchers: POST/DELETE /tasks/{id}/watch, isWatching on tasks.
- Daily summary at a chosen time: overdue, today, tomorrow, plus the
  count of the next 7 days; nothing due, nothing sent.
- Migration 7; jobs do not run in the demo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/mail_test.go

@@ -175,13 +175,13 @@ func TestSendMailStartTLSWithSelfSignedCertificate(t *testing.T) {
 	f := startFakeSMTP(t, "")
 
 	// The certificate is self-signed: refused unless verification is switched off
-	err := sendMail(f.settings(false), "anna@example.com", "Test", "Hallo")
+	err := sendMail(f.settings(false), "anna@example.com", "Test", "Hallo", "")
 	var stepErr *smtpStepError
 	if !errors.As(err, &stepErr) || stepErr.Step != "STARTTLS" {
 		t.Fatalf("expected a STARTTLS error with verification on, got %v", err)
 	}
 
-	if err := sendMail(f.settings(true), "anna@example.com", "⏰ Aufgabe fällig: Müll", "Zeile 1\nZeile 2 mit Ümlaut"); err != nil {
+	if err := sendMail(f.settings(true), "anna@example.com", "⏰ Aufgabe fällig: Müll", "Zeile 1\nZeile 2 mit Ümlaut", ""); err != nil {
 		t.Fatalf("send with SkipVerify failed: %v", err)
 	}
 	f.mu.Lock()
@@ -206,7 +206,7 @@ func TestSendMailStartTLSWithSelfSignedCertificate(t *testing.T) {
 
 func TestSendMailReportsTheRefusingStep(t *testing.T) {
 	f := startFakeSMTP(t, "451 4.3.2 Internal server error")
-	err := sendMail(f.settings(true), "anna@example.com", "Test", "Hallo")
+	err := sendMail(f.settings(true), "anna@example.com", "Test", "Hallo", "")
 	var stepErr *smtpStepError
 	if !errors.As(err, &stepErr) || stepErr.Step != "RCPT TO" || !strings.Contains(err.Error(), "451") {
 		t.Fatalf("expected the 451 to be reported at RCPT TO, got %v", err)
@@ -218,7 +218,7 @@ func TestSendMailWithDisplayNameSender(t *testing.T) {
 	f := startFakeSMTP(t, "")
 	cfg := f.settings(true)
 	cfg.From = "MindSift Alarme <alarm@firma.de>"
-	if err := sendMail(cfg, "Anna <anna@example.com>", "Test", "Hallo"); err != nil {
+	if err := sendMail(cfg, "Anna <anna@example.com>", "Test", "Hallo", ""); err != nil {
 		t.Fatalf("send failed: %v", err)
 	}
 	f.mu.Lock()
@@ -244,7 +244,7 @@ func TestAuthFallsBackToLogin(t *testing.T) {
 	f := startFakeSMTP(t, "")
 	f.authMechs = "PLAIN LOGIN"
 	f.authFail["PLAIN"] = "451 4.3.2 Internal server error"
-	if err := sendMail(f.settings(true), "anna@example.com", "Test", "Hallo"); err != nil {
+	if err := sendMail(f.settings(true), "anna@example.com", "Test", "Hallo", ""); err != nil {
 		t.Fatalf("LOGIN fallback should succeed: %v", err)
 	}
 	f.mu.Lock()
@@ -257,7 +257,7 @@ func TestAuthFallsBackToLogin(t *testing.T) {
 func TestAuthLoginOnlyAndBothFailing(t *testing.T) {
 	f := startFakeSMTP(t, "")
 	f.authMechs = "LOGIN"
-	if err := sendMail(f.settings(true), "anna@example.com", "Test", "Hallo"); err != nil {
+	if err := sendMail(f.settings(true), "anna@example.com", "Test", "Hallo", ""); err != nil {
 		t.Fatalf("LOGIN-only server: %v", err)
 	}
 
@@ -265,7 +265,7 @@ func TestAuthLoginOnlyAndBothFailing(t *testing.T) {
 	g.authMechs = "PLAIN LOGIN"
 	g.authFail["PLAIN"] = "451 4.3.2 Internal server error"
 	g.authFail["LOGIN"] = "451 4.3.2 Internal server error"
-	err := sendMail(g.settings(true), "anna@example.com", "Test", "Hallo")
+	err := sendMail(g.settings(true), "anna@example.com", "Test", "Hallo", "")
 	if err == nil || !strings.Contains(err.Error(), "PLAIN") || !strings.Contains(err.Error(), "LOGIN") || !strings.Contains(err.Error(), "SASL") {
 		t.Fatalf("expected both mechanisms and the server hint in the error, got %v", err)
 	}