[codex] Add browser notifications

[wca4a]

Summary

Adds true browser Notification API support for Tlon web while the tab is open or backgrounded.

• subscribes the web app to %activity updates and emits native browser notifications for shouldNotify activity events
• adds a browser notification permission hook with secure-context/support guards
• exposes a browser notification permission row in notification settings using the current master settings UI

Notes

This does not implement closed-tab Web Push. That would require service worker push handling plus PushManager/VAPID/provider support.

The remote does not have a branch named stable, so this branch is based on origin/master, which appears to be the stable/release branch.

Validation

• git diff --check passed
• On the original working branch before rebasing to master: pnpm --filter 'tlon-web' tsc passed and pnpm --filter 'tlon-web' build passed
• After rebasing to origin/master, pnpm --filter 'tlon-web' tsc --pretty false is blocked by existing stable-branch/local dependency issues unrelated to this patch, including @urbit/aura export mismatches and missing native/web dependency typings
• After reinstalling master dependencies with pnpm install --frozen-lockfile --force, pnpm --filter 'tlon-web' build starts and transforms the app but is blocked by an existing expo-audio web export mismatch (PLAYBACK_STATUS_UPDATE is not exported by ExpoAudio.web.js)

Manual Test

Verified locally against https://malmur-halmex.tlon.network through the web dev server. Browser permission state appears under Settings -> Notification settings -> Browser notifications, and blocked origins report Blocked in browser.

[jamesacklin]

Will want to target develop with this.