feat(db): phase 4 group 1 — lib/ settings + notifications to Drizzle

Convert lib/settings.ts, lib/notifications/{in-app,email,capa-escalation,
effectiveness-recheck}.ts from Supabase PostgREST to Drizzle asAdmin queries.
Drop supabase arg from all call sites in app/api/ and cron routes. Rewrite
notification unit tests to mock @/lib/db/with-user instead of SupabaseClient.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/capa/[id]/verify/route.ts

@@ -56,7 +56,7 @@ export async function POST(
   })
 
   if (capa.owner_user_id) {
-    await createInAppNotifications(supabase, [{
+    await createInAppNotifications([{
       userId: capa.owner_user_id,
       title: body.verdict === 'verified'
         ? 'Your CAPA action was verified'

app/api/capa/route.ts

@@ -67,7 +67,7 @@ export async function POST(request: NextRequest) {
     p_new_value: { incident_id, description, owner_user_id, department, due_date },
   })
 
-  await createInAppNotifications(supabase, [{
+  await createInAppNotifications([{
     userId: owner_user_id,
     title: `CAPA assigned to you, due ${due_date}`,
     link: `/hse/capa/${capa.id}`,