feat: per-user notifications (ntfy + RSS), deduplicated actions, backfill task

Notifications:
- New /notifications page accessible to all users (ntfy + RSS config)
- ntfy now supports no-auth, Bearer token, and HTTP Basic auth (for ACL-protected self-hosted servers)
- RSS enabled/disabled independently of ntfy; token auto-generated on first GET
- Notification settings removed from admin-only Settings page; replaced with link card
- Sidebar adds Notifications nav link for all users
- notification_dispatcher.py: fan-out now marks RSS events dispatched independently

Action history:
- Migration 0012: deduplicates existing bill_actions rows and adds UNIQUE(bill_id, action_date, action_text)
- congress_poller.py: replaces existence-check inserts with ON CONFLICT DO NOTHING (race-condition safe)
- Added backfill_all_bill_actions task (no date filter) + admin endpoint POST /backfill-all-actions

Authored-By: Jack Levy

backend/alembic/versions/0010_backfill_bill_congress_urls.py

@@ -0,0 +1,56 @@
+"""backfill bill congress_urls with proper public URLs
+
+Bills stored before this fix have congress_url set to the API endpoint
+(https://api.congress.gov/v3/bill/...) instead of the public page
+(https://www.congress.gov/bill/...). This migration rebuilds all URLs
+from the congress_number, bill_type, and bill_number columns which are
+already stored correctly.
+
+Revision ID: 0010
+Revises: 0009
+Create Date: 2026-03-01
+"""
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0010"
+down_revision = "0009"
+branch_labels = None
+depends_on = None
+
+_BILL_TYPE_SLUG = {
+    "hr": "house-bill",
+    "s": "senate-bill",
+    "hjres": "house-joint-resolution",
+    "sjres": "senate-joint-resolution",
+    "hres": "house-resolution",
+    "sres": "senate-resolution",
+    "hconres": "house-concurrent-resolution",
+    "sconres": "senate-concurrent-resolution",
+}
+
+
+def _ordinal(n: int) -> str:
+    if 11 <= n % 100 <= 13:
+        return f"{n}th"
+    suffixes = {1: "st", 2: "nd", 3: "rd"}
+    return f"{n}{suffixes.get(n % 10, 'th')}"
+
+
+def upgrade():
+    conn = op.get_bind()
+    bills = conn.execute(
+        sa.text("SELECT bill_id, congress_number, bill_type, bill_number FROM bills")
+    ).fetchall()
+    for bill in bills:
+        slug = _BILL_TYPE_SLUG.get(bill.bill_type, bill.bill_type)
+        url = f"https://www.congress.gov/bill/{_ordinal(bill.congress_number)}-congress/{slug}/{bill.bill_number}"
+        conn.execute(
+            sa.text("UPDATE bills SET congress_url = :url WHERE bill_id = :bill_id"),
+            {"url": url, "bill_id": bill.bill_id},
+        )
+
+
+def downgrade():
+    # Original API URLs cannot be recovered — no-op
+    pass

backend/alembic/versions/0011_add_notifications.py

@@ -0,0 +1,39 @@
+"""add notifications: rss_token on users, notification_events table
+
+Revision ID: 0011
+Revises: 0010
+Create Date: 2026-03-01
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+revision = "0011"
+down_revision = "0010"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column("users", sa.Column("rss_token", sa.String(), nullable=True))
+    op.create_index("ix_users_rss_token", "users", ["rss_token"], unique=True)
+
+    op.create_table(
+        "notification_events",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("user_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("bill_id", sa.String(), sa.ForeignKey("bills.bill_id", ondelete="CASCADE"), nullable=False),
+        sa.Column("event_type", sa.String(50), nullable=False),
+        sa.Column("payload", postgresql.JSONB(astext_type=sa.Text()), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()")),
+        sa.Column("dispatched_at", sa.DateTime(timezone=True), nullable=True),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_notification_events_user_id", "notification_events", ["user_id"])
+    op.create_index("ix_notification_events_dispatched_at", "notification_events", ["dispatched_at"])
+
+
+def downgrade():
+    op.drop_table("notification_events")
+    op.drop_index("ix_users_rss_token", table_name="users")
+    op.drop_column("users", "rss_token")

backend/alembic/versions/0012_dedupe_bill_actions_unique.py

@@ -0,0 +1,32 @@
+"""Deduplicate bill_actions and add unique constraint on (bill_id, action_date, action_text)
+
+Revision ID: 0012
+Revises: 0011
+"""
+from alembic import op
+
+revision = "0012"
+down_revision = "0011"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # Remove duplicate rows keeping the lowest id for each (bill_id, action_date, action_text)
+    op.execute("""
+        DELETE FROM bill_actions a
+        USING bill_actions b
+        WHERE a.id > b.id
+          AND a.bill_id = b.bill_id
+          AND a.action_date IS NOT DISTINCT FROM b.action_date
+          AND a.action_text IS NOT DISTINCT FROM b.action_text
+    """)
+    op.create_unique_constraint(
+        "uq_bill_actions_bill_date_text",
+        "bill_actions",
+        ["bill_id", "action_date", "action_text"],
+    )
+
+
+def downgrade():
+    op.drop_constraint("uq_bill_actions_bill_date_text", "bill_actions", type_="unique")