feat: bounty board, task lifecycle, AI work performer flow, notifications (phase 8)

- whitelist HTML sanitizer (stdlib tokenizer) with XSS vector tests
- developer board: pool-scoped visibility, customer/search/minBounty/sort
  filters, stale-task age badges, competing-claims visibility setting,
  saved filters in profile extras
- claims: request/withdraw (developer), approve/decline (consultant) with
  notifications to winners and losers; unassign/abandon back to board
- work tracking: start, sanitized comments with @mention notifications,
  time logging, submit for review
- review queue + review with per-AC checklist stored on the timeline;
  approve writes the immutable bountyAwards row (human assignees only)
- assign-to-AI: §5.2 job submission, HMAC-verified callback endpoint,
  idempotent by jobId, artifacts downloaded into GridFS, failure path
  keeps the task assigned with timeline + notification
- notifications API + bell with unread badge, dropdown, page, WS toasts
- pages: bounty board, my-tasks kanban, task detail (role-driven actions,
  review dialog, AI dialog), review queue, developer pool

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/templates/layout.html

@@ -30,6 +30,14 @@
     </div>
     <div class="right">
       <button class="btn ghost small" id="nav-theme" type="button" aria-label="Toggle dark / light theme">◐</button>
+      {{if .User}}
+        <span style="position:relative">
+          <button class="btn ghost small" id="nav-bell" type="button" aria-label="Notifications">🔔<span class="bell-badge" id="nav-bell-count" hidden></span></button>
+          <div id="notif-panel" class="notif-panel" hidden>
+            <ul id="notif-list" class="notif-list"></ul>
+            <a href="/notifications" class="muted">All notifications →</a>
+          </div>
+        </span>{{end}}
       {{if .User}}
         <a href="/profile" aria-label="Your profile">
           {{if .User.AvatarFileID}}
@@ -49,6 +57,7 @@
   </main>
   <div id="toasts" aria-live="polite"></div>
   <script type="module" src="/static/js/nav.js"></script>
+  {{if .User}}<script type="module" src="/static/js/notifications.js"></script>{{end}}
   {{range .Scripts}}<script type="module" src="{{.}}"></script>
   {{end}}
 </body>