panel-notifications: schema and store

Migration 0004_notifications.sql, DDL only: users.notify, a user's own
switch, on by default; notify_state, one row per subject the panel has
written about (dns:<domain>, cert, queue, limit:<domain>:<login>), so that
each thing is said once and a restart says nothing again.

Store: the instance switch as a settings key, on unless turned off;
SetUserNotify; NotifyRecipients - global users for everything, domain users
for the domains on their list or all of them, only with an e-mail and their
switch on, a shared mailbox once; the state's get, set, delete and list by
prefix; LimitRefusalsSince, the mail refused under a level-2 limit per domain
and application.

Nothing is sent yet. Checked on Windows: go vet clean, go test
./internal/store passes with the schema test at user_version 4. The page
guards fail from the design commit 87fa0a4 until the pages are built.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans/panel-notifications.md

@@ -108,7 +108,7 @@ to the owner before any code ([panel-redesign.md](panel-redesign.md)
 ## Implementation checklist
 
 - [x] Mockups: Account checkbox, Settings switch and records, Health status card, help topic; accepted by the owner 2026-10-12 (`design:` commit)
-- [ ] Migration and store: user flag, instance switch, event state
+- [x] Migration and store: user flag, instance switch, event state
 - [ ] Sending: local submission from `postmaster@<hostname>`, message text
 - [ ] Background checker: DNS, certificate, queue; the rules of *When a message is sent*
 - [ ] Level-2 refusal event