feat(db): phase 4 group 1 — lib/ settings + notifications to Drizzle

Convert lib/settings.ts, lib/notifications/{in-app,email,capa-escalation,
effectiveness-recheck}.ts from Supabase PostgREST to Drizzle asAdmin queries.
Drop supabase arg from all call sites in app/api/ and cron routes. Rewrite
notification unit tests to mock @/lib/db/with-user instead of SupabaseClient.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/incidents/ai/quality-check/route.ts

@@ -22,7 +22,7 @@ export async function POST(request: NextRequest) {
   if ((recentCount ?? 0) > 0)
     return NextResponse.json({ error: 'Rate limited — please wait 60 seconds' }, { status: 429 })
 
-  const deepseekKey = await getApiKey(supabase, 'DEEPSEEK_API_KEY')
+  const deepseekKey = await getApiKey('DEEPSEEK_API_KEY')
   const client = createDeepSeekClient(deepseekKey)
 
   let body: { description?: string; incident_type?: string }