feat: add guest notification center

docs/prp/07-guest-pwa.md

@@ -37,6 +37,10 @@ Core Features
 - Safety & abuse controls
   - Rate limits per device and IP; content-length checks; mime/type sniffing.
   - Upload moderation state: pending → approved/hidden; show local status.
+- Notification Center
+  - Header bell opens a drawer that merges upload queue stats with server-driven notifications (photo highlights, major achievements, host broadcasts, upload failure hints, feedback reminders).
+  - Data fetched from `/api/v1/events/{token}/notifications` with `X-Device-Id` for per-device read receipts; guests can mark items as read/dismissed and follow CTAs (internal routes or external links).
+  - Pull-to-refresh + background poll every 90s to keep single-day events reactive without WS infrastructure.
 - Privacy & legal
   - First run shows legal links (imprint/privacy); consent for push if enabled.
   - No PII stored; guest name is optional free text and not required by default.
@@ -97,6 +101,8 @@ API Touchpoints
 - POST `/api/v1/events/{token}/photos` — signed upload initiation; returns URL + fields.
 - POST (S3) — direct upload to object storage; then backend finalize call.
 - POST `/api/v1/photos/{id}/like` — idempotent like with device token.
+- GET `/api/v1/events/{token}/notifications` — list guest notifications (requires `X-Device-Id`).
+- POST `/api/v1/events/{token}/notifications/{notification}/read|dismiss` — mark/dismiss notification with device identity.
 
 Limits (MVP defaults)
 - Max uploads per device per event: 50