feat: granular per-category push notification settings

New Settings → Notifications section with a toggle per category (follow,
comment, reply, reaction, rating, mention, leftover-expiring, shared
shopping list) — previously it was all-or-nothing (browser permission only).

userNotificationPrefs (one row per user, defaults all-on so existing users
see no behavior change until they opt out of something). Gated the push
send in the three places that dispatch one: lib/notifications.ts (the 6
in-app notification types), the leftover-expiry cron, and shopping-list-notify
— in-app notification-center entries and email are unaffected, this only
gates the push itself, matching the literal ask.

Verified locally: GET/PUT round-trips correctly, disabling a category
and confirming the settings page renders all 8 toggles.

apps/web/app/api/internal/cron/leftover-reminders/route.ts

@@ -5,6 +5,7 @@ import { sendEmail, notificationEmailHtml } from "@/lib/email";
 import { sendPushNotification } from "@/lib/push";
 import { isLeftoverExpiringSoon } from "@/lib/leftover-match";
 import { getMessages, formatMessage } from "@/lib/i18n/server";
+import { isNotificationCategoryEnabled } from "@/lib/notification-prefs";
 
 // Internal cron endpoint — triggered daily by a cron container (see
 // compose.prod.yml / cron/crontab). Not part of the public API surface;
@@ -53,11 +54,14 @@ export async function POST(req: NextRequest) {
     const title = messages.notifications.pushTitle.leftoverExpiring;
     const body = formatMessage(template, { dish: log.batchDish.name, title: log.recipe.title });
     const url = `/recipes/${log.recipe.id}`;
+    const pushEnabled = await isNotificationCategoryEnabled(log.user.id, "leftoverExpiring");
 
     await Promise.all([
-      sendPushNotification(log.user.id, { title, body, url }).catch((err) => {
-        console.error("[leftover-reminders] push failed", err);
-      }),
+      pushEnabled
+        ? sendPushNotification(log.user.id, { title, body, url }).catch((err) => {
+            console.error("[leftover-reminders] push failed", err);
+          })
+        : Promise.resolve(),
       log.user.email
         ? sendEmail({
             to: log.user.email,