feat(notifications): add ntfy as a first-class notification channel

Adds ntfy.sh (and self-hosted instances) as a new push notification
channel with full parity to the existing webhook channel.

- Backend: NtfyConfig type, getUserNtfyConfig, getAdminNtfyConfig,
  resolveNtfyUrl, sendNtfy (header-based API with Title/Priority/Tags/
  Click headers), testNtfy, NTFY_EVENT_META (priority + emoji tags per
  event), SSRF guard via existing checkSsrf + createPinnedDispatcher
- notificationPreferencesService: ntfy added to NotifChannel union,
  IMPLEMENTED_COMBOS, getActiveChannels parser, getAvailableChannels,
  ADMIN_GLOBAL_CHANNELS, and AvailableChannels interface
- notificationService: per-user ntfy dispatch after webhook block;
  admin-scoped ntfy via getAdminGlobalPref for version_available events
- Routes: POST /api/notifications/test-ntfy with saved-token fallback
- authService: admin_ntfy_server/topic/token in ADMIN_SETTINGS_KEYS,
  masked + encrypted on read/write
- settingsService: ntfy_token added to ENCRYPTED_SETTING_KEYS
- Frontend: ntfy topic/server/token inputs + Save/Test/Clear buttons in
  NotificationsTab; admin Ntfy panel in AdminPage; testNtfy API method
- i18n: full English strings; English placeholders in 14 other locales
- Tests: resolveNtfyUrl, sendNtfy, dispatch integration, UI tests,
  MSW handler for test-ntfy endpoint

client/src/i18n/translations/it.ts

@@ -1763,14 +1763,27 @@ const it: Record<string, string | { name: string; category: string }[]> = {
   'settings.webhookUrl.label': 'URL webhook',
   'settings.webhookUrl.placeholder': 'https://discord.com/api/webhooks/...',
   'settings.webhookUrl.hint': 'Inserisci il tuo URL webhook Discord, Slack o personalizzato per ricevere notifiche.',
-  'settings.webhookUrl.save': 'Salva',
   'settings.webhookUrl.saved': 'URL webhook salvato',
   'settings.webhookUrl.test': 'Test',
   'settings.webhookUrl.testSuccess': 'Webhook di test inviato con successo',
   'settings.webhookUrl.testFailed': 'Invio webhook di test fallito',
+  'settings.ntfyUrl.topicLabel': 'Ntfy Topic',
+  'settings.ntfyUrl.topicPlaceholder': 'my-trek-alerts',
+  'settings.ntfyUrl.serverLabel': 'Ntfy Server URL (optional)',
+  'settings.ntfyUrl.serverPlaceholder': 'https://ntfy.sh',
+  'settings.ntfyUrl.hint': 'Enter your ntfy topic to receive push notifications. Leave server blank to use the default configured by your admin.',
+  'settings.ntfyUrl.tokenLabel': 'Access Token (optional)',
+  'settings.ntfyUrl.tokenHint': 'Required for password-protected topics.',
+  'settings.ntfyUrl.saved': 'Ntfy settings saved',
+  'settings.ntfyUrl.test': 'Test',
+  'settings.ntfyUrl.testSuccess': 'Test ntfy notification sent successfully',
+  'settings.ntfyUrl.testFailed': 'Test ntfy notification failed',
+  'settings.ntfyUrl.clearToken': 'Clear',
+  'settings.ntfyUrl.tokenCleared': 'Access token cleared',
   'settings.notificationPreferences.inapp': 'In-App',
   'settings.notificationPreferences.webhook': 'Webhook',
   'settings.notificationPreferences.email': 'Email',
+  'settings.notificationPreferences.ntfy': 'Ntfy',
   'admin.notifications.emailPanel.title': 'Email (SMTP)',
   'admin.notifications.webhookPanel.title': 'Webhook',
   'admin.notifications.inappPanel.title': 'In-App',
@@ -1781,6 +1794,22 @@ const it: Record<string, string | { name: string; category: string }[]> = {
   'admin.notifications.adminWebhookPanel.testSuccess': 'Webhook di test inviato con successo',
   'admin.notifications.adminWebhookPanel.testFailed': 'Invio webhook di test fallito',
   'admin.notifications.adminWebhookPanel.alwaysOnHint': 'Il webhook admin si attiva automaticamente quando è configurato un URL',
+  'admin.notifications.ntfy': 'Ntfy',
+  'admin.notifications.testNtfy': 'Send test ntfy',
+  'admin.notifications.testNtfySuccess': 'Test ntfy sent successfully',
+  'admin.notifications.testNtfyFailed': 'Test ntfy failed',
+  'admin.notifications.adminNtfyPanel.title': 'Admin Ntfy',
+  'admin.notifications.adminNtfyPanel.hint': 'This ntfy topic is used exclusively for admin notifications (e.g. version alerts). It is separate from per-user topics and always fires when configured.',
+  'admin.notifications.adminNtfyPanel.serverLabel': 'Ntfy Server URL',
+  'admin.notifications.adminNtfyPanel.serverPlaceholder': 'https://ntfy.sh',
+  'admin.notifications.adminNtfyPanel.topicLabel': 'Admin Topic',
+  'admin.notifications.adminNtfyPanel.topicPlaceholder': 'trek-admin-alerts',
+  'admin.notifications.adminNtfyPanel.tokenLabel': 'Access Token (optional)',
+  'admin.notifications.adminNtfyPanel.saved': 'Admin ntfy settings saved',
+  'admin.notifications.adminNtfyPanel.test': 'Send test ntfy',
+  'admin.notifications.adminNtfyPanel.testSuccess': 'Test ntfy sent successfully',
+  'admin.notifications.adminNtfyPanel.testFailed': 'Test ntfy failed',
+  'admin.notifications.adminNtfyPanel.alwaysOnHint': 'Admin ntfy always fires when a topic is configured',
   'admin.notifications.adminNotificationsHint': 'Configura quali canali consegnano le notifiche admin (es. avvisi di versione). Il webhook si attiva automaticamente se è impostato un URL webhook admin.',
   'admin.tabs.notifications': 'Notifiche',
   'notifications.versionAvailable.title': 'Aggiornamento disponibile',