Add notification preferences and alternate dues payment options

Notification preferences (migration 048):
- Per-member opt-out of muteable categories (bookings, classes, forms,
  admin alerts); billing is always-on. Opt-out model, default on.
- Dispatcher reads prefs and marks muted outbox rows 'skipped' instead
  of sending; pure isMuted logic, fail-open on a prefs lookup error.
- notification_preferences table (default-deny RLS); /me toggles and
  self-view via validated service-client actions.

Alternate dues payment methods (migration 049):
- Admin sets external pay-here URLs per platform (PayPal/Zeffy/Venmo)
  in /settings; members see active ones on /me and pay off-platform;
  the treasurer reconciles manually (platform pre-tagged). https-only.
- dues_payment_methods table (SELECT space member, write admin/board).

/me visual pass:
- Restore the chip/preset profile editor (skills/interests/willing-to/
  affiliations); promote ChipInput and presets to shared modules.
- Gate the Stripe pay-dues button on whether the space has Stripe
  configured; show external links or a contact-admin note otherwise.

__tests__/dues-payments-logic.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from 'vitest'
+import {
+  DUES_LINK_PLATFORMS,
+  DUES_PLATFORM_LABEL,
+  isDuesLinkPlatform,
+  isSafeDuesUrl,
+} from '@/lib/dues-payments-logic'
+
+describe('DUES_LINK_PLATFORMS', () => {
+  it('is the url-based subset, excluding cash and stripe', () => {
+    expect(DUES_LINK_PLATFORMS).toEqual(['paypal', 'zeffy', 'venmo'])
+    expect((DUES_LINK_PLATFORMS as readonly string[]).includes('cash')).toBe(false)
+    expect((DUES_LINK_PLATFORMS as readonly string[]).includes('stripe')).toBe(false)
+  })
+
+  it('has a label for every platform', () => {
+    for (const p of DUES_LINK_PLATFORMS) expect(DUES_PLATFORM_LABEL[p]).toBeTruthy()
+  })
+})
+
+describe('isDuesLinkPlatform', () => {
+  it('accepts the link platforms', () => {
+    expect(isDuesLinkPlatform('paypal')).toBe(true)
+    expect(isDuesLinkPlatform('venmo')).toBe(true)
+  })
+  it('rejects cash, stripe, and junk', () => {
+    expect(isDuesLinkPlatform('cash')).toBe(false)
+    expect(isDuesLinkPlatform('stripe')).toBe(false)
+    expect(isDuesLinkPlatform('bogus')).toBe(false)
+  })
+})
+
+describe('isSafeDuesUrl', () => {
+  it('accepts absolute https URLs', () => {
+    expect(isSafeDuesUrl('https://paypal.me/myspace')).toBe(true)
+    expect(isSafeDuesUrl('https://www.zeffy.com/en-US/donation-form/abc')).toBe(true)
+  })
+  it('rejects http (plaintext downgrade)', () => {
+    expect(isSafeDuesUrl('http://paypal.me/myspace')).toBe(false)
+  })
+  it('rejects javascript:, data:, and other schemes (XSS)', () => {
+    expect(isSafeDuesUrl('javascript:alert(1)')).toBe(false)
+    expect(isSafeDuesUrl('data:text/html,<script>')).toBe(false)
+    expect(isSafeDuesUrl('mailto:[email protected]')).toBe(false)
+  })
+  it('rejects relative or unparseable input', () => {
+    expect(isSafeDuesUrl('/paypal')).toBe(false)
+    expect(isSafeDuesUrl('paypal.me/x')).toBe(false)
+    expect(isSafeDuesUrl('')).toBe(false)
+  })
+})