feat(notifications): Slack, Telegram, and in-app notification channels

[simonjcarr]

Summary

• Slack & Telegram channels — new notification channel types with UI dialogs in the Alerts page, Go dispatch via Slack Incoming Webhooks (Block Kit) and Telegram Bot API (HTML parse_mode), TypeScript CRUD actions including masked bot token and send-test support
• In-app notifications — new notifications table, Go ingest fan-out on every alert fire/resolve (reads org settings to determine eligible users by role/opt-out), server actions for fetch/mark-read/delete
• Notification bell — topbar Bell icon with red unread badge, dropdown of 10 recent notifications (severity dot, subject, relative timestamp), click navigates to resource, footer links to full page
• Notifications page (/notifications) — filterable All/Unread tabs, expandable cards with body text and resource link, mark-as-read/delete per item, mark-all-read, paginated (25/page)
• Org notification settings — new card in Settings for admins: enable/disable in-app, role selection, allow-user-opt-out toggle
• User opt-out — Notifications card on Profile page, respects org-level allow-opt-out flag
• Sidebar link — Notifications entry (BellPlus icon) added to Monitoring group
• DB migration — 0026_youthful_anthem.sql adds notifications table, notifications_enabled column on user, and notification settings to org metadata

Test plan

• pnpm run db:generate && pnpm run db:migrate — migration applies cleanly (already done)
• pnpm run build — zero TypeScript errors (already verified)
• go build ./... — Go compiles cleanly (already verified)
• Create a Slack channel in Alerts → send test → verify Slack message received
• Create a Telegram channel in Alerts → send test → verify Telegram message received
• Settings → Notification Settings card appears for admins, saves correctly
• Profile → Notifications opt-out toggle visible; disabled when org disallows opt-out
• Trigger an alert — verify notification bell badge increments and notification appears in dropdown
• Click a notification → navigates to host/certificate resource page
• Click "View all notifications" → /notifications page renders with full list
• Mark as read / mark all → unread badge updates correctly
• Delete a notification → removed from list

🤖 Generated with Claude Code