feat: granular per-category push notification settings

New Settings → Notifications section with a toggle per category (follow,
comment, reply, reaction, rating, mention, leftover-expiring, shared
shopping list) — previously it was all-or-nothing (browser permission only).

userNotificationPrefs (one row per user, defaults all-on so existing users
see no behavior change until they opt out of something). Gated the push
send in the three places that dispatch one: lib/notifications.ts (the 6
in-app notification types), the leftover-expiry cron, and shopping-list-notify
— in-app notification-center entries and email are unaffected, this only
gates the push itself, matching the literal ask.

Verified locally: GET/PUT round-trips correctly, disabling a category
and confirming the settings page renders all 8 toggles.

apps/web/app/api/internal/cron/leftover-reminders/route.ts

@@ -5,6 +5,7 @@ import { sendEmail, notificationEmailHtml } from "@/lib/email";
 import { sendPushNotification } from "@/lib/push";
 import { isLeftoverExpiringSoon } from "@/lib/leftover-match";
 import { getMessages, formatMessage } from "@/lib/i18n/server";
+import { isNotificationCategoryEnabled } from "@/lib/notification-prefs";
 
 // Internal cron endpoint — triggered daily by a cron container (see
 // compose.prod.yml / cron/crontab). Not part of the public API surface;
@@ -53,11 +54,14 @@ export async function POST(req: NextRequest) {
     const title = messages.notifications.pushTitle.leftoverExpiring;
     const body = formatMessage(template, { dish: log.batchDish.name, title: log.recipe.title });
     const url = `/recipes/${log.recipe.id}`;
+    const pushEnabled = await isNotificationCategoryEnabled(log.user.id, "leftoverExpiring");
 
     await Promise.all([
-      sendPushNotification(log.user.id, { title, body, url }).catch((err) => {
-        console.error("[leftover-reminders] push failed", err);
-      }),
+      pushEnabled
+        ? sendPushNotification(log.user.id, { title, body, url }).catch((err) => {
+            console.error("[leftover-reminders] push failed", err);
+          })
+        : Promise.resolve(),
       log.user.email
         ? sendEmail({
             to: log.user.email,

apps/web/app/api/v1/users/me/notification-prefs/route.ts

@@ -0,0 +1,47 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, userNotificationPrefs, eq } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { getNotificationPrefs } from "@/lib/notification-prefs";
+import { z } from "zod";
+
+const PutSchema = z.object({
+  follow: z.boolean().optional(),
+  comment: z.boolean().optional(),
+  reply: z.boolean().optional(),
+  reaction: z.boolean().optional(),
+  rating: z.boolean().optional(),
+  mention: z.boolean().optional(),
+  leftoverExpiring: z.boolean().optional(),
+  shoppingList: z.boolean().optional(),
+});
+
+export async function GET() {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const prefs = await getNotificationPrefs(session!.user.id);
+  return NextResponse.json({ data: prefs });
+}
+
+export async function PUT(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const parsed = PutSchema.safeParse(await req.json());
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  }
+
+  const body = parsed.data;
+  const userId = session!.user.id;
+
+  await db
+    .insert(userNotificationPrefs)
+    .values({ id: crypto.randomUUID(), userId, ...body, updatedAt: new Date() })
+    .onConflictDoUpdate({
+      target: userNotificationPrefs.userId,
+      set: { ...body, updatedAt: new Date() },
+    });
+
+  return NextResponse.json({ ok: true });
+}