feat(notifications): add NotificationsPublisher (outbox-backed) — GOO-173

Phase 1 step 2 — introduce the publisher primitive that emits
notification.requested envelopes through the RFC-004 transactional
outbox. Listeners and command handlers will migrate onto this in a
follow-up commit (flag-gated cutover).

- NotificationsPublisher exposes:
  * publishWithin(tx, input) — preferred; appends to outbox inside an
    existing Prisma transaction so the row commits atomically with the
    domain mutation that triggered the notification
  * publishStandalone(input) — opens a single-row tx; convenience for
    callers that don't already own one
- Builds EventEnvelope<NotificationRequestedPayload> via the Phase 0
  envelope builder (UUIDv7 eventId, current trace id, ISO occurredAt)
- Producer string: "goodgo-api/notifications"; eventType:
  "notification.requested"
- aggregateId on outbox row = notificationId for downstream tracing
- Optional fields (locale, priority, dedupeKey) only included when set,
  matching the JSON Schema's additionalProperties=false contract

Tests (4 specs, all green):
- publishWithin builds a valid envelope (assertValidEnvelope) and writes
  to the supplied tx with aggregateId
- publishStandalone opens its own transaction
- Optional fields are omitted when undefined and preserved when provided
- UUIDv7 eventIds are strictly time-ordered between successive calls

Not yet wired in NotificationsModule providers — that lands with the
listener cutover in the next commit so we don't ship dead DI nodes.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/vitest.config.ts

@@ -3,6 +3,7 @@ import react from '@vitejs/plugin-react';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
+  root: path.resolve(__dirname, '.'),
   plugins: [react()],
   test: {
     include: ['**/__tests__/**/*.spec.ts', '**/__tests__/**/*.test.ts', '**/__tests__/**/*.spec.tsx', '**/__tests__/**/*.test.tsx'],