feat(m5): notifications & activity log foundation

- Expand NotificationRepository (unread list paginated, count, markRead
  ownership-scoped); new ActivityLogRepository (create, findByProject
  paginated) with deterministic created_at+id ordering
- NotificationService (notifyOnEvent, resolveTargets for 8 event types,
  injectable SseBroadcaster for M8) + ActivityLogService (logActivity,
  listByProject)
- NotificationEvent/SseEvent/SseBroadcaster types in lib/types
- APIs: GET /api/notifications, POST /api/notifications/:id/read,
  GET /api/projects/:projectId/activity
- Screens: notifications list + MarkReadButton, NotificationBadge in
  Header, project activity page + ProjectNav link
- Unit tests for both repositories and services (28 new)

app/api/notifications/[id]/read/route.ts

@@ -0,0 +1,25 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getCurrentUser } from '@/lib/auth/getCurrentUser';
+import { createNotificationService } from '@/lib/api/services';
+import { UnauthorizedError, NotFoundError } from '@/lib/errors';
+import { handleApiError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function POST(
+  _request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const user = await getCurrentUser();
+  if (!user) {
+    return handleApiError(new UnauthorizedError());
+  }
+  const { id } = await params;
+
+  const service = createNotificationService();
+  const updated = service.markRead(Number(id), user.id);
+  if (!updated) {
+    return handleApiError(new NotFoundError('Notification', id));
+  }
+  return NextResponse.json({ ok: true });
+}