[Notifications] Connect service for channels and rules with server-side org enforcement

The Connect surface for rule and channel CRUD, plus a synthetic `Test` for channels that runs without saving them into Alertmanager.

Checklist:

- [ ] `proto/notifications/v1/notifications.proto` declares `ChannelService` (Create/Get/List/Update/Delete/Test) and `RuleService` (Create/Get/List/Update/Delete/Validate/ListFiringAlerts). `RuleExpression { template_values | raw_promql }` oneof; rule templates cover `Offline|Hashrate|Temperature|Pool|Command|Custom`.
- [ ] buf lint clean; Go and TS generated through the existing `buf generate`.
- [ ] Handler package `server/internal/handlers/notifications` reads `organization_id` from the auth interceptor's context, never from the request body.
- [ ] Cross-org rejection assertion in every method test. Helper added to `server/internal/testutil` so future PRs reuse it.
- [ ] `ChannelService.Test` accepts an unsaved or saved channel definition, builds a synthetic Alertmanager-shaped payload, and delivers it directly: SMTP via the SMTP infrastructure, webhook via the safe outbound client (Issue 7). Returns delivery status, response code, and error detail. Rate-limited per user (1/min).