feat(12-04): tender-radar notification-pref service + routes, instantAlert passthrough

- TenderNotificationPrefService: per-user digestInterval CRUD (default
  'daily', upsert on @@unique userId, D-01/D-03)
- UpdateNotificationPrefDto: @IsIn(['daily','weekly','off']) validation (V5)
- GET/PUT /modules/tender-radar/notification-pref, declared before
  @Get(':id') (route-order pitfall)
- instantAlert passthrough in Create/UpdateSavedSearchDto and
  TenderSavedSearchService.create/update (NOTIFY-02, D-04)
- All pref/profile routes scoped strictly via extractTriageContext(req),
  never from body/query (T-12-14, IDOR)
- Updated tenders.controller.spec.ts fakes for the new constructor param

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/tenders/tenders.module.ts

@@ -10,6 +10,7 @@ import { TenderIngestionService } from './tender-ingestion.service';
 import { TenderMailService } from './tender-mail.service';
 import { TenderMatchingService } from './tender-matching.service';
 import { TenderNormalizerService } from './tender-normalizer.service';
+import { TenderNotificationPrefService } from './tender-notification-pref.service';
 import { TenderSavedSearchService } from './tender-saved-search.service';
 import { TenderSchedulerService } from './tender-scheduler.service';
 import { TenderTriageService } from './tender-triage.service';
@@ -51,6 +52,13 @@ import { TendersController } from './tenders.controller';
  * TenderMailService can inject SettingsService. ScheduleModule.forRoot()
  * is already registered globally in AppModule — not re-imported here.
  *
+ * Phase 12, Plan 04 (NOTIFY-01/02) adds TenderNotificationPrefService: a
+ * per-user digestInterval CRUD service (same userId-scoping convention as
+ * TenderSavedSearchService, no forTenant()/RLS) backing the new GET/PUT
+ * notification-pref controller routes. instantAlert (NOTIFY-02) needed no
+ * new provider — it rides the existing TenderSavedSearchService create/
+ * update path via the extended saved-search DTOs.
+ *
  * Seeds itself into the module registry on application startup via
  * OnModuleInit lifecycle hook — same pattern as DkvModule.
  */
@@ -67,6 +75,7 @@ import { TendersController } from './tenders.controller';
     TenderMatchingService,
     TenderMailService,
     TenderDigestScheduler,
+    TenderNotificationPrefService,
   ],
 })
 export class TendersModule implements OnModuleInit {