feat(api): read-all takes an optional up_to cutoff (M489)

POST /api/me/notifications/read-all accepts {"up_to": RFC3339}. Android
queues "mark all read" for replay when offline, and a replay landing later
must not mark notices that arrived in between, which the user never saw.
A coalesced notice updated since then has a newer created_at, so it stays
unread. An empty body still marks everything.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/me_notifications.go

@@ -3,6 +3,7 @@ package api
 import (
 	"encoding/json"
 	"errors"
+	"io"
 	"net/http"
 	"strconv"
 	"strings"
@@ -170,7 +171,20 @@ func (h *handlers) handleMarkAllMyNotificationsRead(w http.ResponseWriter, r *ht
 	if !ok {
 		return
 	}
-	if _, err := dbq.New(h.pool).MarkAllNotificationsRead(r.Context(), user.ID); err != nil {
+	// Optional {"up_to": RFC3339}: only what existed then. A client replaying
+	// an offline "mark all read" sends the moment the user asked.
+	var body struct {
+		UpTo *time.Time `json:"up_to"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil && !errors.Is(err, io.EOF) {
+		writeErr(w, apierror.BadRequest("bad_body", "invalid JSON body"))
+		return
+	}
+	params := dbq.MarkAllNotificationsReadParams{UserID: user.ID}
+	if body.UpTo != nil {
+		params.UpTo = pgtype.Timestamptz{Time: *body.UpTo, Valid: true}
+	}
+	if _, err := dbq.New(h.pool).MarkAllNotificationsRead(r.Context(), params); err != nil {
 		writeErrWithLog(w, h.logger, "notifications: mark all read", apierror.Internal(err))
 		return
 	}