feat(notification): add desktop notification settings with an honest permission surface

Settings → General gains a "Desktop notifications" section: master switch,
delivery gate (always / window unfocused / window hidden), a "hide contents"
switch, and per-event switches for the six things codeg notifies about.
Preferences are per-device (localStorage), mirroring the notification-sound
section beside it. Defaults reproduce the previous behaviour exactly, so the
release that introduces the preference does not silently stop delivering.

Fixes found while building it:

- Browser permission could never be granted. requestPermission() was only
  reachable past `if (!document.hidden) return`, i.e. only from a backgrounded
  page carrying no user activation. Requests now originate solely from the
  Settings button.
- Remote-desktop windows lost every notification. Delivery went through
  getTransport(), which is the remote HTTP transport there, while
  send_notification is a tauri-runtime-only command codeg-server never
  registers. Routed through getShellTransport() instead.
- Desktop delivery results were discarded (`let _ = ...send()`). The command
  now returns real errors, surfaced by a "send a test" button — desktop has no
  queryable permission (tauri-plugin-notification hard-codes Granted and
  mac-notification-sys has no such API), so the UI reports "managed by the
  system" rather than inventing a state.
- question_request raised no notification even though it blocks the agent.
- A settled batch sent one notification per task; now folded into one.

Adds open_system_notification_settings as a dedicated Rust command rather than
a widened opener scope: opener's default scope permits only http/https/mailto/
tel, and relaxing it would open custom schemes to all renderer code, including
the markdown rendered from agent output.