Codex: Keep new notifications unread

[keilogic]

/claim #743

Summary

• Keep newly-created notifications server-owned as unread by applying read: false after the caller payload.
• Preserve normal caller payload fields such as message and type.
• Add focused regression tests for default unread creation and caller-supplied read: true override prevention.

Closes #1997
References #743

Demo / Evidence

Focused test output:

✔ createNotification starts new notifications unread
✔ createNotification ignores caller supplied read state

Validation

• node --check apps/api/src/services/notificationService.js
• node --check apps/api/src/tests/notificationService.test.js
• node --test apps/api/src/tests/notificationService.test.js
• node --test apps/api/src/tests/*.test.js
• git diff --check

Known upstream test-script note: npm test -w apps/api still fails because the existing script invokes node --test src/tests as a directory path in this checkout. The explicit API test files above pass.