feat: notification settings per role + review/unread-msg notifications

- Add notificationSettings JSONB to role_permissions (migration 089)
- sendPushForNotification() — pushes only to users with the notif type enabled
- reviews.ts — push + in-app on new direct and QR reviews
- room-service.ts — use sendPushForNotification('room_service_order')
- publicWidget.ts — push + in-app on new online booking
- jobs.ts — runUnreadMessagesJob() every 15 min, deduped by in-process set
- UsersPage: NOTIFICATION_GROUPS UI in roles tab with per-type toggles
- api.ts / RolePermissionsContext: notificationSettings in types and save()

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/api.ts

@@ -313,7 +313,7 @@ export const api = {
         'GET', `/api/hotels/${slug}/role-permissions`),
 
     save: (slug: string, roleKey: string, data: {
-      name: string; color: string; isSystem: boolean; permissions: Record<string, boolean>; homePage?: string | null
+      name: string; color: string; isSystem: boolean; permissions: Record<string, boolean>; homePage?: string | null; notificationSettings?: Record<string, boolean>
     }) =>
       req<import('../contexts/RolePermissionsContext').SavedRolePermission>(
         'PUT', `/api/hotels/${slug}/role-permissions/${roleKey}`, data),