Add durable local Electron notifications with preference routing and deep links

[manishiitg]

Implementation follow-up to #136. Phase 1 is local desktop delivery only while Electron/backend is running.

Backend

• channel-neutral notification intent API
• app-level SQLite outbox with logical intent + per-channel delivery status
• preference router for desktop/in-app/email fallback or both
• global authenticated desktop stream/long poll and ack endpoints
• bridge heartbeat/permission availability, expiry, dedup, rate limiting, retry
• notify_user reports queued/delivered/skipped/failed honestly

Electron

• main-process subscriber displays Electron Notification
• ack displayed/failed/clicked/dismissed
• restore/focus window on click
• validated preload IPC target queued until renderer is ready
• shared navigation opens workflow/session/run/step/Pulse decision

Frontend

• one explicit permission onboarding control; remove auto permission requests from feedback component mounts
• preferences by event type/channel
• migrate duplicate direct browser Notification effects to the central path
• read state shared with in-app notifications

Defaults

Human input and novel high/critical blocked/failed events may use desktop with email fallback. Routine progress stays in-app. Normal completion desktop is opt-in. Agents do not select channels.

Acceptance

• macOS and Windows tests/manual matrix
• minimized app receives and deep-links correctly
• no active tab required
• permission denied/app bridge absent produces honest fallback/status
• duplicate/retry/reconnect does not repeat alerts
• reload click target is queued and applied once
• secret redaction, content bounds, internal-target validation, auth tests
• app fully closed is documented as no desktop delivery in Phase 1

Remote APNs/device push is explicitly out of scope until SSO/device identity exists.