feat: web push notifications, mobile-ready (PRD §5.6)

ADR 0003: VAPID self-hosted today, DeviceToken model agnostic to
platform so iOS/Android (Expo/APNs/FCM) plug in as new senders later.

Backend (apps/api/src/modules/notifications)
- sender.ts: NotificationSender interface, WebPushSender via VAPID
- notifications.routes.ts: GET /me/notifications/config, POST/DELETE
  /me/device-tokens, PATCH /me/notifications/settings, POST /me/notifications/test
- scheduler.ts: node-cron Mon 09:00 Europe/Rome for weekly weigh-in
  reminder; auto-cleanup of expired tokens on 404/410
- env: VAPID_PUBLIC_KEY/PRIVATE_KEY/SUBJECT (all optional → push gracefully off)

Frontend
- public/sw.js minimal (push + notificationclick)
- lib/notifications/push-client.ts: subscribe / unsubscribe / getCurrentSubscription
- profile/notifications-{actions,panel}.tsx: editorial panel with toggles,
  device list, "send test", per-device removal
- pushReady requires both permission AND active subscription (covers the
  case where the user revoked the SW but kept the browser permission)

Schema
- DeviceToken { userId, platform, endpoint, p256dh, auth, token, userAgent,
  createdAt, lastSeenAt } with unique(userId, endpoint)
- ExtendedPrismaClient type exported from @ketopath/db
- NotificationSettings zod schema in @ketopath/shared

Tooling
- lint-staged: split .js out of eslint glob so service worker is only
  formatted (it lives outside the TS project)

i18n
- Notifications namespace (it) with typed error keys

Smoke tested: POST /me/device-tokens 201, POST /me/notifications/test 200,
real push delivered to a macOS Chrome device.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/src/app/[locale]/profile/page.tsx

@@ -7,6 +7,8 @@ import { Masthead } from '@/components/masthead';
 import { getServerSession } from '@/lib/auth';
 
 import { fetchProfile } from './actions';
+import { fetchNotificationConfig } from './notifications-actions';
+import { NotificationsPanel } from './notifications-panel';
 import { ProfileForm } from './profile-form';
 
 export default async function ProfilePage({ params: { locale } }: { params: { locale: string } }) {
@@ -21,14 +23,17 @@ export default async function ProfilePage({ params: { locale } }: { params: { lo
   if (!user?.disclaimerAcceptedAt) redirect('/welcome');
 
   const profile = (await fetchProfile()) as Parameters<typeof ProfileForm>[0]['initial'];
+  const notifications = await fetchNotificationConfig();
 
-  return <ProfilePageContent initial={profile} />;
+  return <ProfilePageContent initial={profile} notifications={notifications} />;
 }
 
 function ProfilePageContent({
   initial,
+  notifications,
 }: {
   initial: Parameters<typeof ProfileForm>[0]['initial'];
+  notifications: Awaited<ReturnType<typeof fetchNotificationConfig>>;
 }) {
   const t = useTranslations('Profile');
 
@@ -50,6 +55,12 @@ function ProfilePageContent({
         <div className="animate-fade-up [animation-delay:300ms]">
           <ProfileForm initial={initial} />
         </div>
+
+        <div className="rule animate-rule-in my-16 [animation-delay:480ms]" />
+
+        <div className="animate-fade-up [animation-delay:540ms]">
+          <NotificationsPanel initial={notifications} />
+        </div>
       </main>
     </div>
   );