feat(notifications): topic-only input (drop URL validation)

The Settings field is now a plain topic name (e.g. `my-secret-topic`)
instead of a full URL. The transport always posts to
`https://ntfy.sh/<topic>` (URL-encoded), and the only server-side check
is "non-empty when enabled". Removes the user-visible
"string does not match the expected pattern" error people hit when
typing a bare topic.

- packages/core/src/notifications/ntfy.ts: drop validateTopicUrl;
  add buildNtfyUrl(topic) + exported NTFY_BASE_URL.
- packages/core/src/notifications/types.ts, config.ts: rename
  topicUrl -> topic; update docs.
- packages/api/src/routes/notifications.ts: only validates non-empty
  topic when enabled. Also fixes a latent bug where notifySubagents
  was dropped on every PUT (was not passed to normalizeNtfyConfig).
- packages/frontend/src/lib/components/SettingsPanel.svelte: relabel
  field "Topic URL" -> "Topic"; placeholder "your-secret-topic";
  updated helper copy.
- Tests updated: rewrote validateTopicUrl coverage as buildNtfyUrl
  coverage + proof that previously-rejected topics (dots, spaces,
  unicode, "Any Topic Whatsoever") now POST cleanly.
- HANDOFF.md: added a short "topic-only input" section.

1 files changed, 7 insertions, 7 deletions

diff --git a/packages/frontend/src/lib/components/SettingsPanel.svelte b/packages/frontend/src/lib/components/SettingsPanel.svelte
index 08e86ac..dc9d07d 100644
--- a/packages/frontend/src/lib/components/SettingsPanel.svelte
+++ b/packages/frontend/src/lib/components/SettingsPanel.svelte
@@ -32,7 +32,7 @@ type NotificationEventType =
 
 interface NtfyConfigView {
 	enabled: boolean;
-	topicUrl: string;
+	topic: string;
 	authToken: string;
 	hasAuthToken?: boolean;
 	events: Record<NotificationEventType, boolean>;
@@ -48,7 +48,7 @@ const NTFY_EVENT_LABELS: Record<NotificationEventType, string> = {
 
 const DEFAULT_NTFY: NtfyConfigView = {
 	enabled: false,
-	topicUrl: "",
+	topic: "",
 	authToken: "",
 	hasAuthToken: false,
 	events: {
@@ -162,7 +162,7 @@ async function saveNtfy(): Promise<void> {
 		// `authToken: ""` ⇒ explicit clear (the user typed and cleared).
 		const payload: Partial<NtfyConfigView> & { authToken?: string } = {
 			enabled: ntfy.enabled,
-			topicUrl: ntfy.topicUrl,
+			topic: ntfy.topic,
 			events: ntfy.events,
 			notifySubagents: ntfy.notifySubagents,
 		};
@@ -421,15 +421,15 @@ $effect(() => {
 		</label>
 
 		<label class="text-xs text-base-content/60 flex flex-col gap-1">
-			Topic URL
+			Topic
 			<input
 				type="text"
 				class="input input-bordered input-sm w-full"
-				placeholder="https://ntfy.sh/your-secret-topic"
-				bind:value={ntfy.topicUrl}
+				placeholder="your-secret-topic"
+				bind:value={ntfy.topic}
 			/>
 			<span class="text-[10px] text-base-content/40">
-				Pick something unguessable — anyone with the URL can read your notifications.
+				Any string — pick something unguessable, since anyone with the topic name can read your notifications. Subscribe to the same topic in the ntfy app.
 			</span>
 		</label>