feat(federation): peering-notifications endpoints + janitor expiry fanout

- GET /api/federation/peering-notifications (?unread=1 filter)
- POST /api/federation/peering-notifications/:id/read (per-row mark-read)
- POST /api/federation/peering-notifications/read-all (bulk mark-read,
  preserves already-read readAt; returns affected count)
- janitor: outbound expired rows fan out kind='expired' notifications
  to each subscriber before cascade-deleting parent (replaces Task 1's
  scaffolding 'continue' guard); inbound expired rows are deleted outright
  (both sides expire independently — no cross-instance network call)
- janitor: 30-day cleanup pass for read notifications
  (cleanupReadPeeringNotifications); unread rows persist indefinitely
- cleanupExpiredApprovalRequests is now sync (no async network IO)

Notes:
- No WS broadcast on janitor expiry — offline users see notifications on
  next GET, matching the persistence guarantee of the notifications table.
- The previous /peer/denied network call on inbound expiry is removed;
  symmetric per-side expiry now handles termination on both sides.

Tests: 12 new (3 + 4 endpoint cases on 3 endpoints; 2 outbound/inbound
janitor expiry cases + 1 not-yet-expired guard + 1 retention sweep);
247 server tests passing total.

packages/server/src/routes/federation.ts

@@ -1852,6 +1852,92 @@ export async function federationRoutes(app: FastifyInstance): Promise<void> {
     },
   );
 
+  // ─── GET /api/federation/peering-notifications ─────────────────────────────
+  // User-facing: list the requesting user's terminal-state peering
+  // notifications (kind='approved'|'denied'|'expired'). Optional ?unread=1
+  // filter narrows to rows where readAt IS NULL. Ordered DESC by createdAt
+  // (newest first).
+  app.get<{ Querystring: { unread?: string } }>(
+    '/api/federation/peering-notifications',
+    { preHandler: [authenticate] },
+    async (request, reply) => {
+      const db = getDb();
+      const userId = request.userId;
+      const unread = request.query?.unread === '1';
+
+      const whereClause = unread
+        ? and(
+            eq(schema.peerApprovalNotifications.userId, userId),
+            isNull(schema.peerApprovalNotifications.readAt),
+          )
+        : eq(schema.peerApprovalNotifications.userId, userId);
+
+      const notifications = db
+        .select()
+        .from(schema.peerApprovalNotifications)
+        .where(whereClause)
+        .orderBy(desc(schema.peerApprovalNotifications.createdAt))
+        .all();
+
+      return reply.send({ notifications });
+    },
+  );
+
+  // ─── POST /api/federation/peering-notifications/:id/read ───────────────────
+  // User-facing: mark a single peering notification as read. Authorization:
+  // notification.userId must match request.userId.
+  app.post<{ Params: { id: string } }>(
+    '/api/federation/peering-notifications/:id/read',
+    { preHandler: [authenticate] },
+    async (request, reply) => {
+      const db = getDb();
+      const { id } = request.params;
+      const userId = request.userId;
+
+      const notif = db
+        .select()
+        .from(schema.peerApprovalNotifications)
+        .where(eq(schema.peerApprovalNotifications.id, id))
+        .get();
+      if (!notif) {
+        return reply.code(404).send({ error: 'notification_not_found', statusCode: 404 });
+      }
+      if (notif.userId !== userId) {
+        return reply.code(403).send({ error: 'forbidden', statusCode: 403 });
+      }
+
+      db.update(schema.peerApprovalNotifications)
+        .set({ readAt: Date.now() })
+        .where(eq(schema.peerApprovalNotifications.id, id))
+        .run();
+      return reply.send({ success: true });
+    },
+  );
+
+  // ─── POST /api/federation/peering-notifications/read-all ───────────────────
+  // User-facing: mark all the requesting user's unread peering notifications
+  // as read. Already-read rows are NOT touched (their readAt is preserved).
+  // Returns the count of rows affected for UI feedback.
+  app.post(
+    '/api/federation/peering-notifications/read-all',
+    { preHandler: [authenticate] },
+    async (request, reply) => {
+      const db = getDb();
+      const userId = request.userId;
+      const result = db
+        .update(schema.peerApprovalNotifications)
+        .set({ readAt: Date.now() })
+        .where(
+          and(
+            eq(schema.peerApprovalNotifications.userId, userId),
+            isNull(schema.peerApprovalNotifications.readAt),
+          ),
+        )
+        .run();
+      return reply.send({ success: true, count: result.changes });
+    },
+  );
+
   // ─── POST /api/federation/peers/:id/rotate ──────────────────────────────────
   // Admin-only: trigger immediate secret rotation for a peer.
   app.post<{ Params: { id: string } }>(