feat(notify): bundled notifications, task watchers, daily summary

- Per-user routing (own mail / own Discord webhook) for task alarms
  (sent at once), shares, completed shared tasks and watched tasks;
  settings as JSON on the user (GET /auth/me, PATCH /auth/settings).
- Everything but alarms is queued and sent as one message per user
  after NOTIFY_DIGEST_MINUTES (default 5); mails now multipart with an
  HTML version, Discord as one embed. Three failed attempts drop it.
- Own changes never notify the actor, except on watched tasks when
  asked for; "paused" stops everything including alarms.
- Task watchers: POST/DELETE /tasks/{id}/watch, isWatching on tasks.
- Daily summary at a chosen time: overdue, today, tomorrow, plus the
  count of the next 7 days; nothing due, nothing sent.
- Migration 7; jobs do not run in the demo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server.go

@@ -34,6 +34,10 @@ type Server struct {
 	streamTickets streamTickets // one-time tickets for WebSocket/SSE (streamticket.go)
 	loginGuard    *loginGuard   // brute-force protection (loginguard.go)
 	voice         *voiceService // self-hosted speech recognition (voice.go)
+
+	// Replace the delivery of bundled notifications in tests (notify.go)
+	notifyEmailHook   func(to, subject, text, html string) error
+	notifyDiscordHook func(webhookURL, heading string, items []notifyItem) error
 }
 
 func NewServer(cfg *config.Config, store *storage.Store, wsHub *ws.Hub, staticFS fs.FS) *Server {
@@ -62,6 +66,7 @@ func NewServer(cfg *config.Config, store *storage.Store, wsHub *ws.Hub, staticFS
 	}
 	if !cfg.DemoMode {
 		go srv.startAlarmTicker() // the demo sends nothing (FLAW-33)
+		go srv.startNotificationJobs()
 		go srv.startBackupScheduler()
 	}
 	return srv
@@ -136,6 +141,8 @@ func (s *Server) Router() http.Handler {
 		r.Post("/api/v1/documents/{id}/media/fetch", s.notInDemo(s.handleFetchMedia))
 		r.Get("/api/v1/media/{id}", s.handleGetMedia)
 		r.Post("/api/v1/documents/{id}/extract", s.handleExtractBranch)
+		r.Post("/api/v1/tasks/{id}/watch", s.handleWatchTask)
+		r.Delete("/api/v1/tasks/{id}/watch", s.handleWatchTask)
 		r.Post("/api/v1/documents/{id}/extract/undo", s.handleUndoExtract)
 		r.Post("/api/v1/documents/{id}/merge", s.handleMergeDocuments)
 		r.Post("/api/v1/documents/{id}/merge/undo", s.handleUndoMerge)