feat: granular per-category push notification settings

New Settings → Notifications section with a toggle per category (follow,
comment, reply, reaction, rating, mention, leftover-expiring, shared
shopping list) — previously it was all-or-nothing (browser permission only).

userNotificationPrefs (one row per user, defaults all-on so existing users
see no behavior change until they opt out of something). Gated the push
send in the three places that dispatch one: lib/notifications.ts (the 6
in-app notification types), the leftover-expiry cron, and shopping-list-notify
— in-app notification-center entries and email are unaffected, this only
gates the push itself, matching the literal ask.

Verified locally: GET/PUT round-trips correctly, disabling a category
and confirming the settings page renders all 8 toggles.

apps/web/lib/notifications.ts

@@ -3,6 +3,7 @@ import { randomUUID } from "crypto";
 import { sendPushNotification } from "./push";
 import { sendEmail, notificationEmailHtml } from "./email";
 import { getMessages, formatMessage } from "./i18n/server";
+import { isNotificationCategoryEnabled } from "./notification-prefs";
 
 type NotificationType = "follow" | "comment" | "reply" | "reaction" | "rating" | "mention";
 
@@ -75,9 +76,11 @@ async function dispatchAlerts(opts: CreateNotificationOpts): Promise<void> {
     ? (actor.username ? `/u/${actor.username}` : "/")
     : opts.recipeId ? `/recipes/${opts.recipeId}` : "/";
 
-  void sendPushNotification(opts.userId, { title, body, url }).catch((err) => {
-    console.error("[notifications] push failed", err);
-  });
+  if (await isNotificationCategoryEnabled(opts.userId, opts.type)) {
+    void sendPushNotification(opts.userId, { title, body, url }).catch((err) => {
+      console.error("[notifications] push failed", err);
+    });
+  }
 
   if (recipient.email) {
     const baseUrl = process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000";