In-app notification inbox, consolidate /profile into /me, theme realign

In-app notification center (Phase 5, migration 051):
- notifications.read_at + partial unread index. /me Notifications is now
  an inbox: unread styling, click to expand the message + mark read,
  "mark all as read", unread count. markNotificationsRead is a service-
  client write scoped to the caller's own member_id. Always-on channel:
  email-muted ('skipped') notifications still appear in-app.

Consolidate /profile into /me:
- Delete app/(app)/profile/*; /me is the single member page. Port the
  conflict-of-interest privileged-role nudge + last-disclosed date into
  /me's profile editor. Remove the "My profile" sidebar + command-palette
  entries; rename the /me nav label to "My membership". Repoint the
  recruitment empty-state link to /me.

Theme realign:
- Revert the rounded-lg cards introduced in the prior /me visual pass to
  rounded (the app norm, matching the former /profile). Route /me section
  headers through the SectionTitle primitive.

Regression guard:
- integration/auth-embed.test.ts runs the auth layout's
  space_members.select('*, spaces(*)') embed through PostgREST and fails
  on PGRST201, so a future junction table cannot silently break auth again.

lib/actions/notifications.ts

@@ -11,35 +11,84 @@ import {
   type PrefMap,
 } from '@/lib/notifications-prefs-logic'
 
-// The caller's own notification history. The notifications RLS SELECT is
-// admin/board/treasurer only (mirrors member_billing), so the member
-// self-view goes through the validated service client, same as getMyBilling.
+// The caller's own notification history, plus the in-app inbox read state and
+// an unread count. The notifications RLS SELECT is admin/board/treasurer only
+// (mirrors member_billing), so the member self-view goes through the validated
+// service client, same as getMyBilling. body_text is the plain-text message
+// shown when the member expands an inbox item (never body_html, so the inbox
+// never renders untrusted markup).
 export async function getMyNotifications() {
   const supabase = await createClient()
   const auth = await requireMember(supabase)
   if (!auth.ok) return { error: auth.error }
   const { member } = auth
 
-  const { data } = await createAdminClient()
+  const admin = createAdminClient()
+  const { data } = await admin
     .from('notifications')
-    .select('id, type, subject, status, created_at, sent_at')
+    .select('id, type, subject, body_text, status, created_at, sent_at, read_at')
     .eq('space_id', member.space_id)
     .eq('member_id', member.id)
     .order('created_at', { ascending: false })
-    .limit(15)
+    .limit(30)
+
+  const { count } = await admin
+    .from('notifications')
+    .select('id', { count: 'exact', head: true })
+    .eq('space_id', member.space_id)
+    .eq('member_id', member.id)
+    .is('read_at', null)
 
   return {
+    unreadCount: count ?? 0,
     data: (data ?? []).map(r => ({
       id: r.id as string,
       type: r.type as string,
       subject: r.subject as string,
+      bodyText: (r.body_text as string | null) ?? '',
       status: r.status as string,
       createdAt: r.created_at as string,
       sentAt: (r.sent_at as string | null) ?? null,
+      readAt: (r.read_at as string | null) ?? null,
     })),
   }
 }
 
+// Mark the caller's own notifications read (the in-app inbox). With ids, marks
+// just those; without, marks all of the caller's unread. The `.eq('member_id')`
+// scope means ids from another member can never be touched (the id filter only
+// narrows within the caller's own rows). Service-client write, same convention
+// as the rest of the notification self-view (no client write policy).
+export async function markNotificationsRead(
+  input: { ids?: string[] } = {},
+): Promise<{ ok: true } | { error: string }> {
+  const supabase = await createClient()
+  const auth = await requireMember(supabase)
+  if (!auth.ok) return { error: auth.error }
+  const { member } = auth
+
+  let q = createAdminClient()
+    .from('notifications')
+    .update({ read_at: new Date().toISOString() })
+    .eq('space_id', member.space_id)
+    .eq('member_id', member.id)
+    .is('read_at', null)
+
+  if (input.ids && input.ids.length > 0) {
+    // Defend the uuid column against a malformed client id (a non-uuid would
+    // error the cast). Only well-formed ids pass; an empty result is a no-op.
+    const ids = input.ids.filter(id => /^[0-9a-f-]{36}$/i.test(id))
+    if (ids.length === 0) return { ok: true }
+    q = q.in('id', ids)
+  }
+
+  const { error } = await q
+  if (error) return { error: 'Could not update notifications' }
+
+  revalidatePath('/me')
+  return { ok: true }
+}
+
 // The caller's own notification preferences as a category -> enabled map.
 // notification_preferences has no client policy (same convention as
 // notifications / member_billing), so the read goes through the service client