Add notification channels and a provider abstraction

Users get a notification_channels table (replacing users.ntfy_topic); pages fan
out to every enabled channel through a notify.Provider registry, with ntfy as
the first provider. Fallbacks are typed {type, address}. Schema edited in place:
existing databases must be recreated.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

docs/escalation.md

@@ -15,12 +15,12 @@ changes and nobody remembers to edit the policy.
 level 1   5m    oncall            the rota gets first refusal
 level 2   5m    user:bob          then a named second
                                   then repeat_count more rounds
-                                  then the team's fallback topic, once
+                                  then the team's fallback, once
 ```
 
 When a level's timeout passes with the incident still `triggered`, the next
 level is paged. Off the end of the ladder the whole thing runs again
-`repeat_count` times, and after that the team's `fallback_topic` is paged once
+`repeat_count` times, and after that the team's `fallback` is paged once
 as the end of the line. The incident stays open throughout: running out of
 people to wake is not the same as somebody answering.
 
@@ -31,7 +31,7 @@ it is, and it resumes when the snooze runs out.
 
 Every step is on the incident's timeline with the level and the names it woke,
 so somebody reading it afterwards can tell why their phone rang at 04:00. A
-level whose targets are all unreachable — no ntfy topic, a disabled account, an
+level whose targets are all unreachable — no notification channel, a disabled account, an
 empty rota — is recorded as `nobody reachable` and the ladder moves on rather
 than stalling on a rung that cannot ring.
 
@@ -39,7 +39,8 @@ than stalling on a rung that cannot ring.
 escalation; a team without keeps the reminder behaviour exactly as it was. Two
 pages for one silence is the surest way to get a tool muted.
 
-The ladder's `fallback_topic` is per team, unlike `TERDUT_NTFY_FALLBACK_TOPIC`,
-which is the install-wide topic used when an incident opens with nobody on call.
+The ladder's `fallback` is per team and names a provider and an address
+(`{"type": "ntfy", "address": "..."}`), unlike `TERDUT_NTFY_FALLBACK_TOPIC`,
+which is the install-wide ntfy topic used when an incident opens with nobody on call.
 They answer different questions: one is "nobody was scheduled", the other is
 "everybody scheduled has been tried".