feat: notifications in the app and, optionally, by e-mail

Derived from events and kept per person: whoever a ticket is assigned to,
whoever reports or works on it when it moves, fails QA or gets a comment,
and whoever joins a project. Never about what you did yourself, once per
event. They arrive live through a subscription to a bell in the header,
and are copied by e-mail to whoever turns it on when SMTP_URL is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

package.json

@@ -45,6 +45,7 @@
     "ioredis": "^5.11.1",
     "joi": "^18.2.9",
     "mongoose": "^8.24.4",
+    "nodemailer": "^7.0.13",
     "openapi-fetch": "^0.17.0",
     "pg": "^8.23.1",
     "reflect-metadata": "^0.2.0",
@@ -87,6 +88,7 @@
     "@swc/helpers": "~0.5.18",
     "@types/jest": "~30.0.0",
     "@types/node": "^22.0.0",
+    "@types/nodemailer": "^8.0.2",
     "@types/ws": "^8.18.2",
     "@typescript-eslint/utils": "^8.58.0",
     "@vitest/coverage-v8": "~4.1.0",