feat(notifications): requests and flags reach the people who act on them (#5340)

- A new request still pending after any auto-approval notifies the
  admins (request_pending), but not the requester if they are an admin.
  A request that dedups into one already in flight is not announced again.
- Approving or rejecting a request notifies the requester, and a
  rejection carries the admin's notes as the reason. An admin deciding
  their own request gets nothing.
- The reconciler notifies the requester when their request arrives
  (request_completed), linking the matched album or artist.
- A request the re-acquisition sweeper files and cannot approve itself
  notifies the admins.
- A quarantine flag notifies every admin except the flagger, naming the
  track, the flagger and the reason.

lidarrrequests.Service.CreateTracked reports whether a request was
inserted or deduped; Create wraps it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/requests.go

@@ -10,6 +10,7 @@ import (
 	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/lidarrrequests"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/notifications"
 )
 
 // requestView is the JSON shape returned by all /api/requests handlers.
@@ -130,7 +131,7 @@ func (h *handlers) handleCreateRequest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	row, err := h.lidarrRequests.Create(r.Context(), user.ID, lidarrrequests.CreateParams{
+	row, created, err := h.lidarrRequests.CreateTracked(r.Context(), user.ID, lidarrrequests.CreateParams{
 		Kind:             body.Kind,
 		LidarrArtistMBID: body.LidarrArtistMBID,
 		LidarrAlbumMBID:  body.LidarrAlbumMBID,
@@ -175,6 +176,16 @@ func (h *handlers) handleCreateRequest(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// A new request still pending after any auto-approval waits on an admin
+	// (M489). One that deduped into a request already in flight was
+	// announced when it was first made, and the requester, if they are an
+	// admin themselves, needs no notice of their own request.
+	if created && row.Status == dbq.LidarrRequestStatusPending {
+		p := requestPayload(row)
+		p.Actor = userLabel(user)
+		h.notifier.NotifyLogged(r.Context(), notifications.KindRequestPending, notifications.ToAdmins(user.ID), p.Map())
+	}
+
 	h.publishRequestStatusChanged(row)
 	writeJSON(w, http.StatusCreated, requestViewFrom(row))
 }