feat(api): read-all takes an optional up_to cutoff (M489)

POST /api/me/notifications/read-all accepts {"up_to": RFC3339}. Android
queues "mark all read" for replay when offline, and a replay landing later
must not mark notices that arrived in between, which the user never saw.
A coalesced notice updated since then has a newer created_at, so it stays
unread. An empty body still marks everything.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/db/queries/notifications.sql

@@ -57,9 +57,15 @@ UPDATE user_notifications
  WHERE id = sqlc.arg(id) AND user_id = sqlc.arg(user_id);
 
 -- name: MarkAllNotificationsRead :execrows
+-- up_to, when set, limits it to what existed when the user asked: a "mark
+-- all read" queued offline and replayed later must not mark notices that
+-- arrived in between, which the user never saw. A coalesced row updated
+-- since then carries a newer created_at, so it stays unread too.
 UPDATE user_notifications
    SET read_at = now()
- WHERE user_id = $1 AND read_at IS NULL;
+ WHERE user_id = sqlc.arg(user_id)
+   AND read_at IS NULL
+   AND (sqlc.narg(up_to)::timestamptz IS NULL OR created_at <= sqlc.narg(up_to));
 
 -- name: TrimNotifications :execrows
 -- Retention: read rows go after read_cutoff, and anything at all after