Notifications: fix list/count divergence, typed JSONB payloads, live unread SSE

[martsokha]

Summary

Fixes the reported backend bug where GET /notifications/ returned items: [] while GET /notifications/unread/ reported a count > 0 — the list silently dropped rows whose stored params didn't decode, while the count counted them. Along the way the notification/activity payload storage is made typed and fail-closed, event names are normalized, and a live unread-count SSE channel is added.

The core fix (list/count divergence)

from_model returned Option and the list dropped the Nones, so a row whose stored params didn't match its type vanished from the list but still counted toward unread. Now the mapping is total: an undecodable row always appears, only its payload is absent — so the list can never silently disagree with the count over the same rows.

Typed JSONB payloads

• Json<T> — a typed JSONB column wrapper with explicit per-call read policies (strict / or_default / optional), so a column reads as Json<NotificationPayload> rather than a bare Value.
• NotificationPayload / ActivityPayload — internally-tagged enums (notifyType / activityType) with one *Params struct per variant.
• Notification.payload / Activity.payload are Option<P>, omitted when the stored blob doesn't decode. The generated OpenAPI schema is exactly P (optional) — fully typed, no unknown. (An earlier JsonBody<P> = P | Value produced anyOf: [P, <any>], which collapsed to unknown for openapi-typescript consumers; that's now gone.)

Dotted event names

Every event/enum string moves from the mixed colon+dot form (member:invited, connection:sync.completed) to all-dots (member.invited, connection.sync.completed), matching Stripe/GitHub/CloudEvents and making the names valid NATS subjects directly. WebhookEvent::as_subject collapses to self.into() via per-variant strum(serialize).

Live unread-count SSE channel

New GET /notifications/unread/events/ streams the account's unread count over SSE so a badge updates live instead of polling. Modeled on the existing run-status stream: subscribe to the account's core-NATS unread subject before reading the current count, emit it immediately, forward each change, with a 30s DB-reread fallback that self-heals a dropped best-effort broadcast. The emitter broadcasts a fresh count on every insert and the mark-read handlers broadcast the decrement, so the badge tracks both directions. Stored rows stay authoritative; broadcasts are best-effort.

Refactors folded in

• Avatar extractor/response — the avatar upload/serve free fns become one Avatar(Vec<u8>) newtype implementing FromRequest + IntoResponse (+ OpenAPI), moved to crate::extract.
• SseResponse<E> — now holds a boxed, type-erased event stream; new takes impl Stream<Item = Event> and adds the Ok/keep-alive framing internally, so both SSE handlers return a plain Result<SseResponse<E>> instead of leaking impl Stream<Item = Result<Event, Infallible>>.
• Fully-qualified the schema-gated schemars::JsonSchema derive across nvisy-postgres.
• Renamed handler/utility/sse.rs → sse_response.rs.

Testing

Full gate green: cargo check, cargo +nightly fmt --check, cargo clippy -D warnings, cargo test, RUSTDOCFLAGS="-D warnings" cargo doc — all pass. DB reset + make generate-migrations applied cleanly with the dotted enum labels.

🤖 Generated with Claude Code