[NOTIF-001] Platform: Email & in-app notification service

## Overview
Build a centralized notification service that sends transactional emails and (in a future phase) in-app notifications. This is a shared infrastructure component consumed by orders, returns, auth, and support.

## Acceptance Criteria
- [ ] `POST /api/notifications/send` — internal endpoint to queue a notification
- [ ] Template types: order confirmation, order shipped, return approved, welcome email, password reset, promotional
- [ ] Email provider: integrate with a transactional email service (e.g., SendGrid — API key in environment variable)
- [ ] Notification queue with retry logic (3 attempts, exponential backoff)
- [ ] Delivery status tracked: `queued` → `sent` → `delivered` / `failed`
- [ ] In-app notification bell icon in header (Sprint 5 — UI only for now, backend ready)
- [ ] User can unsubscribe from promotional emails (one-click unsubscribe link in all emails)
- [ ] Admin dashboard stub showing notification delivery stats

## Depends On
- #14 ORD-001 — order events are the primary notification triggers

## Note
Auth emails (password reset via #7, verification via #6) should be migrated to use this service once available. For Sprint 2 they can use direct mailer calls.