feat(db): phase 4 group 1 — lib/ settings + notifications to Drizzle

Convert lib/settings.ts, lib/notifications/{in-app,email,capa-escalation,
effectiveness-recheck}.ts from Supabase PostgREST to Drizzle asAdmin queries.
Drop supabase arg from all call sites in app/api/ and cron routes. Rewrite
notification unit tests to mock @/lib/db/with-user instead of SupabaseClient.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/settings.ts

@@ -1,13 +1,17 @@
-import type { SupabaseClient } from '@supabase/supabase-js'
+import 'server-only'
+import { asAdmin } from '@/lib/db/with-user'
+import { appSettings } from '@/lib/db/schema'
+import { eq } from 'drizzle-orm'
 
-export async function getApiKey(supabase: SupabaseClient, key: string): Promise<string> {
+export async function getApiKey(key: string): Promise<string> {
   try {
-    const { data } = await supabase
-      .from('app_settings')
-      .select('value')
-      .eq('key', key)
-      .single()
-    if (data?.value) return data.value
+    const rows = await asAdmin(db =>
+      db.select({ value: appSettings.value })
+        .from(appSettings)
+        .where(eq(appSettings.key, key))
+        .limit(1)
+    )
+    if (rows[0]?.value) return rows[0].value
   } catch {
     // fall through to env
   }