Phase 6: Activity log and notifications

Add activity logging to all write API routes, notification system with
real-time delivery via Socket.IO, @mention parsing in comments, activity
feed sidebar on board page, per-card activity in card modal, and
notification bell with unread badge in the navbar.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/routes/api/notifications/[notificationId]/+server.ts

@@ -0,0 +1,25 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types.js';
+import { withBypassRLS } from '$lib/server/rls.js';
+import { requireAuth } from '$lib/server/guards.js';
+
+export const PATCH: RequestHandler = async ({ params, request, locals }) => {
+	requireAuth(locals.user);
+
+	const body = await request.json();
+
+	const notification = await withBypassRLS(async (tx) => {
+		const existing = await tx.notification.findUnique({
+			where: { id: params.notificationId }
+		});
+		if (!existing) throw error(404, 'Notification not found');
+		if (existing.userId !== locals.user!.id) throw error(403, 'Access denied');
+
+		return tx.notification.update({
+			where: { id: params.notificationId },
+			data: { read: body.read === true }
+		});
+	});
+
+	return json({ notification });
+};