feat(notificaciones): edit summary recipients in the UI

NOTIFICATION_ADMIN_EMAILS made "add Beto to the summaries" a redeploy —
the wrong unit of work for a list that changes when office staff change.

Adds `app_settings`, a key/value table for the configuration staff must
be able to change without a deploy, and `SettingsService`, which resolves
every key db -> env -> default and reports which of the three a value
came from. That ladder is what makes the move safe: a deployment behaves
exactly as before until somebody saves in the UI, and the screen can say
"this is still coming from the deployment" rather than implying somebody
chose it.

- new ability `setting:manage` (ADMIN) — deliberately above
  `notification:send`, since redirecting the audit summaries is how
  someone would quietly stop them being read
- GET/PUT /notifications/settings/admin-emails; read is open to any
  logged-in user so the UI can display the list, write is gated
- resolved per job, not cached at boot, or we would reintroduce exactly
  the restart-to-apply behaviour being removed
- a saved empty list means "nobody" and does NOT fall through to the env,
  or clearing the field would keep mailing the people just removed

Credentials stay in env — see the model doc for where the line is drawn.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/web/src/lib/api.ts

@@ -1186,6 +1186,31 @@ export function listNotificationLog(
   return apiFetch<NotificationLogPage>(`/notifications/log${tail ? `?${tail}` : ""}`);
 }
 
+/** Where a setting's current value came from — shown so an operator can tell
+ *  "nobody has set this, you are seeing the deploy's value" from "somebody
+ *  set this on purpose". */
+export type SettingSource = "db" | "env" | "default";
+
+export interface NotificationAdminEmails {
+  value: string[];
+  source: SettingSource;
+  updatedAt: string | null;
+  updatedById: string | null;
+}
+
+export function getNotificationAdminEmails(): Promise<NotificationAdminEmails> {
+  return apiFetch<NotificationAdminEmails>("/notifications/settings/admin-emails");
+}
+
+export function setNotificationAdminEmails(
+  emails: string[],
+): Promise<NotificationAdminEmails> {
+  return apiFetch<NotificationAdminEmails>("/notifications/settings/admin-emails", {
+    method: "PUT",
+    body: JSON.stringify({ emails }),
+  });
+}
+
 export function getNotificationStats(
   servicio?: NotificationServicio[],
 ): Promise<NotificationStats> {

apps/web/src/lib/types.ts

@@ -28,7 +28,8 @@ export type Ability =
   | "lookup:manage"
   | "user:manage"
   | "db:manage"
-  | "notification:send";
+  | "notification:send"
+  | "setting:manage";
 
 export interface AuthUser {
   id: string;