fix(notifications): address Gemini review — tighten validation, sanitize Click, support Basic auth, non-optimistic UI clear

Acted on 4 of 6 findings from the gemini-3-flash-preview second-opinion
review (the other 2 were verified-wrong or judged not worth the
complexity — see HANDOFF.md).

core/src/notifications/ntfy.ts:
- validateTopicUrl now enforces ntfy's actual topic-name constraints:
  exactly one path segment, 1–64 chars, charset [A-Za-z0-9_-]. Prevents
  users from saving topic URLs that look fine but silently 404 at
  publish time (cf. binwiederhier/ntfy#1451 for the 64-char limit and
  binwiederhier/ntfy's topic-name regex for the charset).
- Click header now passes through sanitizeHeader, closing the same
  CRLF-injection vector that Title/Tags already had.
- Authorization header construction now factors through a small
  buildAuthHeaderValue helper: a value that already starts with a scheme
  token ("Bearer xyz", "Basic dXNlcjpwYXNz") is used verbatim, so users
  of private ntfy servers that want Basic auth can paste the full header
  value. Bare tokens still get the "Bearer " prefix automatically.

frontend/SettingsPanel.svelte:
- clearNtfyAuthToken() was optimistic: it flipped hasAuthToken=false
  locally before awaiting the network call. If the request failed the
  UI lied about server state, and worse — a subsequent Save() with
  authToken:undefined would silently re-arm the original token. Now
  awaits the response, surfaces failures via the existing ntfySaveError
  banner, and only mutates local state on success. Adds a
  ntfyClearingToken loading flag so the button disables + spins during
  the request.

Tests: +6 in ntfy.test.ts (multi-segment rejection, charset rejection,
length boundary, 64-char acceptance, Basic auth pass-through, Click
sanitization). All 442 tests pass; biome clean; svelte-check clean;
manual ntfy.sh end-to-end re-verified.

0 files changed, 0 insertions, 0 deletions