merge: dev into r1/claude-reset-fix

Brings in the n2/ntfy-notifications feature (ntfy.sh push notifications
with per-event toggles, subagent-suppression flag, topic-only input,
Settings UI, dispatcher + transport + config modules, 12+ new tests),
the header declutter (theme picker + Debug panel moved into Settings /
sidebar), the shared theme boot-apply module, and an a11y label for the
remove-panel button.

No code changes from this branch were touched by the merge — the
overlap was purely textual.

Conflict resolution:

1. HANDOFF.md (add/add conflict). Both branches independently put a
   single-purpose HANDOFF.md at the repo root for their respective
   in-flight feature, matching the existing convention (c351719 did
   the same for this branch; 29bdd00 did the same for ntfy). After
   this merge both features ship, so neither is in-flight anymore.
   Archive both into notes/:
     - notes/wake-schedule-handoff.md     (this branch — git tracks as a
                                           rename from HANDOFF.md)
     - notes/ntfy-notifications-handoff.md (dev — recovered from
                                           MERGE_HEAD before deletion)
   The root HANDOFF.md is intentionally absent post-merge; the next
   in-flight branch will create its own.

2. packages/api/tests/routes.test.ts (auto-merged). dev appended ntfy
   stubs to the vi.mock('@dispatch/core', ...) factory; this branch
   appended a 'Wake schedule routes' describe block at the bottom.
   The two regions don't overlap and the textual auto-merge is correct
   (verified: 6 describe blocks, both mock-stub regions and the new
   describe present, no conflict markers).

Verification on the merge commit:

  bun run test       → 31 files, 495 / 495 passing
                       (was 431 on the branch + 64 from dev)
  bun run check      → biome clean, 156 files
  bun run --cwd packages/frontend typecheck
                     → svelte-check 0 errors, 0 warnings

dev can now fast-forward to this commit:
  git checkout dev && git merge --ff-only r1/claude-reset-fix

2 files changed, 149 insertions, 0 deletions

diff --git a/packages/api/tests/permission-manager.test.ts b/packages/api/tests/permission-manager.test.ts
new file mode 100644
index 0000000..172adb3
--- /dev/null
+++ b/packages/api/tests/permission-manager.test.ts
@@ -0,0 +1,99 @@
+import { describe, expect, it, vi } from "vitest";
+
+// Mock @dispatch/core to provide only the PermissionService impl this test
+// touches — the core barrel transitively pulls in bun:sqlite, which vitest
+// running under Node cannot resolve.
+vi.mock("@dispatch/core", async () => {
+	const mod = await import("../../core/src/permission/service.js");
+	return {
+		PermissionService: mod.PermissionService,
+	};
+});
+
+const { PermissionManager } = await import("../src/permission-manager.js");
+
+interface PermissionRequest {
+	permission: string;
+	patterns: string[];
+	always: string[];
+	description: string;
+	metadata: Record<string, unknown>;
+}
+
+function makeRequest(overrides: Partial<PermissionRequest> = {}): PermissionRequest {
+	return {
+		permission: "bash",
+		patterns: ["git *"],
+		always: ["git status"],
+		description: "Run git status",
+		metadata: {},
+		...overrides,
+	};
+}
+
+describe("PermissionManager.onPromptAdded", () => {
+	it("fires once per newly-added pending prompt", () => {
+		const mgr = new PermissionManager();
+		const seen: Array<{ id: string; permission: string }> = [];
+		mgr.onPromptAdded((p) => {
+			seen.push({ id: p.id, permission: p.permission });
+		});
+
+		void mgr.ask(makeRequest(), []);
+		void mgr.ask(makeRequest({ permission: "read", description: "Read X" }), []);
+
+		expect(seen).toHaveLength(2);
+		expect(seen[0].permission).toBe("bash");
+		expect(seen[1].permission).toBe("read");
+		// Distinct ids
+		expect(seen[0].id).not.toBe(seen[1].id);
+	});
+
+	it("does not re-fire when the pending list is rebroadcast for an unrelated change", async () => {
+		const mgr = new PermissionManager();
+		const seen: string[] = [];
+		mgr.onPromptAdded((p) => seen.push(p.id));
+
+		// Two prompts in; should see two notifications.
+		const p1 = mgr.ask(makeRequest(), []);
+		void mgr.ask(makeRequest({ permission: "read" }), []);
+		expect(seen).toHaveLength(2);
+
+		// Resolve the first one — broadcastPending fires again, but the
+		// remaining (already-announced) prompt must NOT re-notify.
+		const pending = mgr.getPending();
+		const firstId = pending[0].id;
+		mgr.reply(firstId, "once");
+		await p1;
+
+		expect(seen).toHaveLength(2);
+	});
+
+	it("unsubscribe stops further notifications", () => {
+		const mgr = new PermissionManager();
+		const seen: string[] = [];
+		const unsub = mgr.onPromptAdded((p) => seen.push(p.id));
+		void mgr.ask(makeRequest(), []);
+		unsub();
+		void mgr.ask(makeRequest({ permission: "read" }), []);
+		expect(seen).toHaveLength(1);
+	});
+
+	it("listener throws are caught and don't break other listeners", () => {
+		const mgr = new PermissionManager();
+		const seen: string[] = [];
+		mgr.onPromptAdded(() => {
+			throw new Error("boom");
+		});
+		mgr.onPromptAdded((p) => seen.push(p.id));
+		// Swallow the warn during this test.
+		const origWarn = console.warn;
+		console.warn = () => {};
+		try {
+			void mgr.ask(makeRequest(), []);
+		} finally {
+			console.warn = origWarn;
+		}
+		expect(seen).toHaveLength(1);
+	});
+});
diff --git a/packages/api/tests/routes.test.ts b/packages/api/tests/routes.test.ts
index f92b94c..c768cee 100644
--- a/packages/api/tests/routes.test.ts
+++ b/packages/api/tests/routes.test.ts
@@ -268,6 +268,56 @@ vi.mock("@dispatch/core", () => ({
 			execute: async () => "mock",
 		};
 	},
+	// ── ntfy notifications stubs ──────────────────────────────────
+	NotificationDispatcher: class MockNotificationDispatcher {
+		attachToAgentManager() {
+			return () => {};
+		}
+		attachToPermissionManager() {
+			return () => {};
+		}
+		notify() {}
+		dispose() {}
+	},
+	loadNtfyConfig() {
+		return {
+			enabled: false,
+			topic: "",
+			authToken: "",
+			events: {
+				"turn-completed": true,
+				"turn-error": true,
+				"permission-required": true,
+				"agent-spawned": false,
+			},
+			notifySubagents: false,
+		};
+	},
+	saveNtfyConfig() {},
+	normalizeNtfyConfig(c: unknown) {
+		return c;
+	},
+	defaultNtfyConfig() {
+		return {
+			enabled: false,
+			topic: "",
+			authToken: "",
+			events: {
+				"turn-completed": true,
+				"turn-error": true,
+				"permission-required": true,
+				"agent-spawned": false,
+			},
+			notifySubagents: false,
+		};
+	},
+	redactNtfyConfig(c: { authToken?: string }) {
+		return { ...c, authToken: "", hasAuthToken: false };
+	},
+	NTFY_EVENT_TYPES: ["turn-completed", "turn-error", "permission-required", "agent-spawned"],
+	async sendNtfy() {
+		return { ok: true };
+	},
 }));
 
 const { app } = await import("../src/app.js");