feat: push+email notifications, recipe notes, fork/clone, pantry-aware lists, GDPR export

Five S-sized items from HANDOFF.md's new-features backlog, all wiring up
previously-orphaned infra:

- createNotification now sends web push + email for every notification type
  (follow/comment/reply/reaction/rating/mention), not just comments
- Personal recipe notes: private per-user notes on any viewable recipe
  (recipeNotes table had zero API/UI before this)
- Recipe fork/clone: deep-copies a viewable recipe into your own library as
  a private draft, linked via recipeVariations, respects tier quota
- Pantry-aware shopping lists: meal-plan-generated lists now subtract
  on-hand pantry quantities (ingredientId match, falling back to normalized
  name match) and flag partial/ambiguous matches instead of guessing
- GDPR data export: downloadable JSON of a user's own content and activity
  across every relevant table, secrets/internal tables excluded

New migrations 0025 (unique index for recipe-notes upsert) and 0026
(shopping_list_items.in_pantry) generated, left unapplied like 0023/0024.
Verified with typecheck, lint, and a full local `docker build`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/email.ts

@@ -95,6 +95,15 @@ export function resetPasswordHtml(url: string) {
   );
 }
 
+export function notificationEmailHtml(title: string, body: string, url: string) {
+  return layout(
+    `${title} — Epicure`,
+    `<h1 style="margin:0 0 8px;font-size:24px;">${title}</h1>
+     <p style="margin:0 0 4px;color:#57534e;line-height:1.6;">${body}</p>
+     ${btn(url, "View on Epicure")}`
+  );
+}
+
 export function welcomeHtml(name: string) {
   return layout(
     "Welcome to Epicure",