feat: expose notification delivery status timeline

[larryjay007]

What

Adds a real delivery-attempt timeline for notifications, addressing the gap that
NotificationOutbox only ever holds the latest attempt (lastAttemptAt/lastError get
overwritten on every retry) — there was previously no way to see attempt 1 vs attempt 2 vs
attempt 3 for debugging a failed notification flow.

Schema

• New DeliveryAttemptOutcome enum (success | failed) and NotificationDeliveryAttempt
  model, related to the existing NotificationOutbox.
• Migration verified for real: built a throwaway SQLite DB from the actual migration history
  via prisma migrate dev, then hand-isolated the generated SQL to just our table. The
  auto-diff also included three unrelated tables (ArtifactAccessToken, ImportJob,
  SorobanEventCorrelation) that exist in schema.prisma but have no migration backing
  them — pre-existing drift, unrelated to this change, excluded from this migration.

Failure categorization

Added notification-failure-classifier.ts, bucketing raw errors into a small fixed set
(timeout, rate_limited, invalid_recipient, provider_error, unknown) rather than
passing raw error text as a metric label. This deliberately diverges from the existing
incrementCallbackFailure/incrementTxSubmissionFailure pattern elsewhere in the codebase,
which uses raw (truncated) error text as a Prometheus label — a cardinality-explosion risk.

Processor

onCompleted/onFailed now also insert a NotificationDeliveryAttempt row and record the
new metrics, alongside the existing NotificationOutbox status update (which remains the
source of truth for "current state"; the new table is the history).

Metrics

Two new counters: notification_delivery_attempts_total (labels: type, outcome) and
notification_delivery_failures_by_category_total (labels: type, failure_category).

Admin endpoints

Both added to the existing OutboxController, matching its ApiKeyGuard/RolesGuard/
@Roles(admin, operator) pattern:

• GET /notifications/outbox/:id/attempts — full timeline for one record.
• GET /notifications/outbox/delivery-attempts — filtered, paginated history
  (outcome, failureCategory, type, from, to, limit, offset).

Note: the filtered endpoint is declared before the existing @Get(':id') route in the
file, since NestJS/Express match routes in declaration order — :id would otherwise
silently capture "delivery-attempts" as an id value and make the new route unreachable.

Testing

npx tsc --noEmit is clean for every file this PR touches. 13 pre-existing TypeScript
errors remain elsewhere in the repo (artifact-token/upload-session spec files, tied to
the same ArtifactAccessToken schema drift noted above) — confirmed via git stash to
predate this change and be unrelated.

Known gap, flagging honestly rather than overclaiming: no automated tests were added yet
for the new code paths (classifier, processor changes, service methods, controller
endpoints). Recommend this as a fast follow-up before merge, or happy to add them if there's
time before review.

Closes #716

[drips-wave]

@larryjay007 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Cedarich]

Kindly fix workflow

[Cedarich]

@larryjay007

[larryjay007]

@Cedarich