feat: integrate ntfy.sh push notifications for supervisor

- Add NTFY_TOKEN support to send_alert() — sends Authorization header
  when token is set, backwards-compatible with plain webhook URLs
- Set ALERT_WEBHOOK_URL and NTFY_TOKEN in .env.prod.sops
- Add NTFY_TOKEN= placeholder in .env.dev.sops
- Topic: gWMeiHxj8ZqLbbqT (hard-to-guess, token-gated)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

PROJECT.md

@@ -225,6 +225,14 @@ _Move here when you start working on it._
 
 ---
 
+## Human Tasks 🧑
+
+> Tasks that require manual setup, external accounts, or human judgement.
+
+- [x] Set up ntfy.sh for supervisor notifications — topic `gWMeiHxj8ZqLbbqT`, token in `.env.prod.sops`
+
+---
+
 ## Decisions Log
 
 | Date | Decision | Rationale |