Implement notifications service with shared messaging and email drivers (#36)

docs/implementation.md

@@ -446,3 +446,34 @@ in each Go module (compile-only for the additional tagged suites). All 233
 provenance source blobs match the pinned revision. `git diff --check` passed.
 No security scans were requested or run. The correction is delivered on `bff-34`
 in [PR #35](https://git.sendico.io/tech/sxchnge/pulls/35), which remains unmerged.
+
+## Notifications service (#36)
+
+- Added independent `backend/notifications` executable with a separate
+  `interface` Go module. Canonical protobuf source:
+  `backend/notifications/interface/proto/v1/interface.proto`. Go bindings are
+  ignored; Make generates them before validation and packages source/client
+  archives without committing generated code.
+- Email-first Send/Get contract, caller-scoped durable idempotency, strict
+  template parameters and HTML escaping, immutable rendered snapshots, expiry,
+  and sanitized per-delivery status. Unsupported channels remain explicit in
+  the contract and fail before enqueueing.
+- SendGrid adapts Sendico's driver to the new rendered-email interface; Resend is
+  a new implementation behind the same shared DriverConfig pattern. No provider
+  managed template or Sendico business-runtime dependency is introduced.
+- Mongo persistence uses shared DBImp/query/patch/index/connection wrappers.
+  The notification document is the atomic outbox. Shared messaging contains the
+  selected Sendico NATS durable adapters, and the executable consumes their
+  Transport/Subscription interfaces for publication, delivery and acknowledgement.
+- Tests cover both provider payloads, authentication, parameters, concurrent
+  idempotency/claims, outbox publication failure, lease recovery, expiry and
+  retries, with disposable MongoDB and NATS containers. Final `make test` and
+  `make lint-backend` passed. `make package-notifications-interface` passed;
+  the extracted client archive passed standalone `go test ./...`. No live
+  email or optional security scan was run.
+- Limitations: email only; no delivery receipts. Ambiguous sends require
+  reconciliation, rather than automatic replay. Initial NATS provisioning uses
+  one replica. Caller services own recipient authorization/preferences. Drain
+  queued work before changing driver/sender configuration.
+- Delivery is stacked on BFF PR #35 (`bff-34`); merge #35 first, then retarget
+  the notifications PR to main. Do not merge without user authorization.