feat(notifications): P2d dispatcher cron route

POST /api/cron/notifications drains <=20 pending rows/min, sends via the
transport with the row id as Resend Idempotency-Key (overlap-safe),
marks sent or increments attempts (retryable -> stay pending, permanent
or budget-exhausted -> failed). Constant-time CRON_SECRET bearer check;
503 when unset. ~4.5/s spacing under Resend's 5/s limit. proxy.ts
whitelists /api/cron (no session; own shared secret). CRON_SECRET added
to .env.example.

proxy.ts

@@ -21,6 +21,9 @@ const PUBLIC_ROUTES = [
   // (Stripe does not follow redirects). Scoped to the webhook path only —
   // the Stripe server actions are invoked from authenticated pages.
   '/api/stripe/webhook',
+  // The notification dispatcher is hit by the droplet's crontab (no
+  // session); it enforces its own CRON_SECRET shared-secret header.
+  '/api/cron',
   // Public form / waiver fill page. Only /f/[slug] lives here and must be
   // reachable anonymously (the page serves only published public forms and
   // submitForm enforces visibility). The /forms* management routes do NOT