feat(api): read-all takes an optional up_to cutoff (M489)

POST /api/me/notifications/read-all accepts {"up_to": RFC3339}. Android
queues "mark all read" for replay when offline, and a replay landing later
must not mark notices that arrived in between, which the user never saw.
A coalesced notice updated since then has a newer created_at, so it stays
unread. An empty body still marks everything.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/library/notify_test.go

@@ -151,7 +151,7 @@ func TestDuplicateSweep_NotifiesOnlyWhenSomethingNewIsProposed(t *testing.T) {
 	}
 	markAllRead := func() {
 		t.Helper()
-		if _, err := q.MarkAllNotificationsRead(ctx, admin.ID); err != nil {
+		if _, err := q.MarkAllNotificationsRead(ctx, dbq.MarkAllNotificationsReadParams{UserID: admin.ID}); err != nil {
 			t.Fatalf("mark read: %v", err)
 		}
 	}