feat(bsky): add private space notification queries - #35

Summary

Keep the standard notification list and unread-count responses limited to public AT URIs, and add authenticated Blacksky queries that return the authorized union of public and private-space notifications. The new routes fail closed for malformed or mixed notification domains and preserve pagination and shared seen-state semantics.

Test plan

• CI passes package codegen and TypeScript build
• CI passes notification contract, pagination, domain, and authorization tests
• CI passes data-plane PostgreSQL coverage for pre-limit filtering, unread counts, moderation, and shared seen state