audit 4: cards ordered by number, a notification owed to each recipient

The cards layout (owner, 2026-10-13; the mockup first, b90a2f0): box_open
writes data-order for a box with InCards and a number, and panel.css orders
by it up to twelve - Health's eight and the kit's three.
TestCardsBoxesCarryTheirNumberAsTheirOrder reads the rendered pages.

Notifications (owner, 2026-10-14): migration 0011, notify_addressees. open
sends a subject's first message to every recipient and records who was
handed it; followUp, on every check while the subject is open and still
wrong, hands it to the owed and untold who are still recipients; closed
sends the end to the told (all recipients for a subject from before the
table). Tests: a failed copy goes out at the next check, once; the hourly
ceiling holds one back; a user added mid-subject hears nothing of it.

Also in the roadmap, from the owner today: dns-record-collapse,
notification-mail-recheck, settings-save-row (agreed, design first).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 644 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/migrations/0011_notify_addressees.sql

@@ -0,0 +1,15 @@
+-- Who a notification is owed to, per subject (audit 2026-10-12, stage 4;
+-- owner, 2026-10-14). A subject used to count as said once one recipient's
+-- copy was handed to Postfix: a recipient whose copy failed, or was held back
+-- by the hourly ceiling, was never told. The recipients a subject's first
+-- message was addressed to are kept here with whether each was handed it;
+-- a later check sends to those not told yet, and "cleared" goes to those who
+-- were told. Rows of a subject go with its notify_state row
+-- (Store.DeleteNotifyState). A subject opened before this file has none, and
+-- is told cleared to every recipient, as before.
+CREATE TABLE notify_addressees (
+    key     TEXT NOT NULL,
+    address TEXT NOT NULL,
+    told_at TEXT NOT NULL DEFAULT '',
+    PRIMARY KEY (key, address)
+);