Add notification channels and a provider abstraction

Users get a notification_channels table (replacing users.ntfy_topic); pages fan
out to every enabled channel through a notify.Provider registry, with ntfy as
the first provider. Fallbacks are typed {type, address}. Schema edited in place:
existing databases must be recreated.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/api/signup.go

@@ -427,53 +427,6 @@ func handleRevokeInvite(db *sql.DB) http.HandlerFunc {
 // Onboarding
 // ---------------------------------------------------------------------------
 
-// handleTestNotification publishes one push to the caller's own topic.
-//
-// The point of the first-run checklist's notification step is not that a topic
-// string has been typed but that a phone buzzes, and only the person holding it
-// can tell whether it did. Published directly rather than through the outbox:
-// the outbox row requires an incident, and this deliberately belongs to no
-// incident.
-func handleTestNotification(cfg NotifyConfig, db *sql.DB) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		if cfg.BaseURL == "" {
-			respond(w, http.StatusServiceUnavailable,
-				errResp("this server has no ntfy configured, so it can send nothing"))
-			return
-		}
-		caller, ok := userFromContext(r.Context())
-		if !ok {
-			respond(w, http.StatusForbidden, errResp("this endpoint is for human accounts only"))
-			return
-		}
-
-		var topic *string
-		if err := db.QueryRowContext(r.Context(),
-			"SELECT ntfy_topic FROM users WHERE id = $1", caller.ID).Scan(&topic); err != nil {
-			serverError(w, r, err)
-			return
-		}
-		if topic == nil || *topic == "" {
-			respond(w, http.StatusBadRequest, errResp("set a notification topic first"))
-			return
-		}
-
-		if err := publish(r.Context(), cfg, ntfyMessage{
-			Topic:   *topic,
-			Title:   "terdut test",
-			Message: "If this arrived, your notifications work.",
-			Tags:    []string{"white_check_mark"},
-		}); err != nil {
-			// The failure is the useful part here: a wrong topic, a token the
-			// ntfy server rejects, or an ntfy that is down all look the same
-			// from the phone, which is silence.
-			respond(w, http.StatusBadGateway, errResp("ntfy rejected the test: "+err.Error()))
-			return
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}
-}
-
 // handleDismissOnboarding hides the first-run checklist, or brings it back.
 // Stored per user rather than in the browser: somebody who finishes setting up
 // on a laptop should not be nagged again on their phone.