feat: granular per-category push notification settings

New Settings → Notifications section with a toggle per category (follow,
comment, reply, reaction, rating, mention, leftover-expiring, shared
shopping list) — previously it was all-or-nothing (browser permission only).

userNotificationPrefs (one row per user, defaults all-on so existing users
see no behavior change until they opt out of something). Gated the push
send in the three places that dispatch one: lib/notifications.ts (the 6
in-app notification types), the leftover-expiry cron, and shopping-list-notify
— in-app notification-center entries and email are unaffected, this only
gates the push itself, matching the literal ask.

Verified locally: GET/PUT round-trips correctly, disabling a category
and confirming the settings page renders all 8 toggles.

apps/web/app/api/v1/users/me/notification-prefs/route.ts

@@ -0,0 +1,47 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, userNotificationPrefs, eq } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { getNotificationPrefs } from "@/lib/notification-prefs";
+import { z } from "zod";
+
+const PutSchema = z.object({
+  follow: z.boolean().optional(),
+  comment: z.boolean().optional(),
+  reply: z.boolean().optional(),
+  reaction: z.boolean().optional(),
+  rating: z.boolean().optional(),
+  mention: z.boolean().optional(),
+  leftoverExpiring: z.boolean().optional(),
+  shoppingList: z.boolean().optional(),
+});
+
+export async function GET() {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const prefs = await getNotificationPrefs(session!.user.id);
+  return NextResponse.json({ data: prefs });
+}
+
+export async function PUT(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const parsed = PutSchema.safeParse(await req.json());
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  }
+
+  const body = parsed.data;
+  const userId = session!.user.id;
+
+  await db
+    .insert(userNotificationPrefs)
+    .values({ id: crypto.randomUUID(), userId, ...body, updatedAt: new Date() })
+    .onConflictDoUpdate({
+      target: userNotificationPrefs.userId,
+      set: { ...body, updatedAt: new Date() },
+    });
+
+  return NextResponse.json({ ok: true });
+}