Hub: add preferences sync endpoint + notification display on customer page

- POST /api/v1/preferences: accepts {customer_id, email, enabled_events} from controller
- GetRecentNotifications() store method for last N notification log entries
- Customer detail page: new Notifications section (email, events, recent log table)
- joinStrings template function for event list display

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hub/internal/api/handler.go

@@ -44,6 +44,8 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		h.handleReport(w, r)
 	case r.Method == http.MethodPost && path == "/notify":
 		h.handleNotify(w, r)
+	case r.Method == http.MethodPost && path == "/preferences":
+		h.handleSavePreferences(w, r)
 	case r.Method == http.MethodGet && path == "/customers":
 		h.handleCustomers(w, r)
 	case r.Method == http.MethodGet && strings.HasPrefix(path, "/customers/"):
@@ -282,6 +284,44 @@ func (h *Handler) handleNotify(w http.ResponseWriter, r *http.Request) {
 	w.Write([]byte(`{"status":"ok","sent":true}`))
 }
 
+// handleSavePreferences stores notification preferences pushed from a customer controller.
+func (h *Handler) handleSavePreferences(w http.ResponseWriter, r *http.Request) {
+	// Same bearer token auth as /report and /notify
+	if h.apiKey != "" {
+		auth := r.Header.Get("Authorization")
+		if !strings.HasPrefix(auth, "Bearer ") || strings.TrimPrefix(auth, "Bearer ") != h.apiKey {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+	}
+
+	body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
+	if err != nil {
+		http.Error(w, "Bad request", http.StatusBadRequest)
+		return
+	}
+
+	var payload struct {
+		CustomerID    string   `json:"customer_id"`
+		Email         string   `json:"email"`
+		EnabledEvents []string `json:"enabled_events"`
+	}
+	if err := json.Unmarshal(body, &payload); err != nil || payload.CustomerID == "" {
+		http.Error(w, "Invalid payload: customer_id required", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.store.SaveNotificationPrefs(payload.CustomerID, payload.Email, payload.EnabledEvents); err != nil {
+		h.logger.Printf("[ERROR] Failed to save notification prefs for %s: %v", payload.CustomerID, err)
+		http.Error(w, "Internal error", http.StatusInternalServerError)
+		return
+	}
+
+	h.logger.Printf("[INFO] Notification preferences updated for %s: email=%s, events=%v", payload.CustomerID, payload.Email, payload.EnabledEvents)
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte(`{"status":"ok"}`))
+}
+
 // sendResendEmail sends an email via the Resend HTTP API.
 func (h *Handler) sendResendEmail(to, subject, textBody string) error {
 	payload := map[string]interface{}{