feat(backend): notify on subscription charge + fix realtime room-broadcast tests

[DeborahOlaboye]

Summary

Resolves four assigned backend issues:

• Notifications: Notify on subscription charge #965 — Notify on subscription charge. Added a subscription_charged notification type, gated by a new per-user subscriptionCharged preference (NotificationPreference model + migration, defaulting to enabled). Wired into the indexer's sub_exec projection (projectSubscriptionCharged), notifying the creator when a charge lands. Guarded by the event-log's isNewEvent flag so replaying the same ledgers never re-notifies.
• Realtime: Realtime tests #957 — Realtime tests (auth handshake + room broadcasts). gateway.test.ts had two silently-broken tests: one signed JWTs with a stale sub claim instead of userId (so the auth handshake never actually authenticated as the expected user, hanging the "delivers balance.updated" test until timeout), and one asserted a stale { message: 'Forbidden' } shape instead of the current { code: 'FORBIDDEN' }. Fixed both. Also added missing room-broadcast coverage for tip.created (creator room) and notification.created (user room), which had zero test coverage before this.
• Notifications: POST /notifications/read-all #961 — POST /notifications/read-all. Already fully implemented and tested on test-implement-drips (route, controller, service, and tests all present). Verified against the issue's acceptance criteria and left as-is.
• Notifications: Notification creation service #962 — Notification creation service. Same as above — createNotification already exists in notifications.service.ts with full test coverage. Verified and left as-is.

Why one PR for four issues

All four are small, tightly-scoped, same-module (backend/src/modules/notifications/, backend/src/realtime/) issues from the same wave assignment, so they're bundled together rather than opening four near-empty PRs.

Test plan

• npx vitest run src/modules/notifications/ src/realtime/ src/indexer/projections.test.ts — all pass (16 realtime + 33 notifications + 41 projections)
• npx eslint on every touched file — 0 errors
• npx tsc --noEmit — no new errors introduced (two pre-existing, unrelated errors remain in src/modules/credit/credit.service.ts and src/modules/tips/tips.test.ts, untouched by this PR)
• DB-backed integration suites (tests/*.test.ts) require a local Postgres/Redis I didn't have running; unaffected by this change (same caveat noted in the prior feat/realtime-notifications-954-955-956-959 PR)

Closes #965
Closes #957
Closes #961
Closes #962

[drips-wave]

@DeborahOlaboye Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits