Add notifications table migration to run-all.js

The migration file existed but was never registered in the POSTGRES_MIGRATIONS
array, so it never ran on production. The missing table caused 500 errors on
GET /api/notifications/count.

.kiro/steering/tech.md

@@ -106,6 +106,18 @@ No ESLint is configured for backend — the pipeline uses `node -c` syntax check
 | Staging | http://71.85.90.9:3100 | Auto-deploy on master push |
 | Local dev (frontend only) | http://localhost:3000 | React dev server with hot-reload, proxies API to :3001 |
 
+## Secure Context Constraints
+
+All environments serve over **plain HTTP** (not HTTPS). This means browser APIs that require a [secure context](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts) are **not available** in production or staging:
+
+- `navigator.clipboard` (Clipboard API) — use `document.execCommand('copy')` with a hidden textarea instead
+- `navigator.share` (Web Share API)
+- `crypto.subtle` (Web Crypto API)
+- `navigator.credentials` (Credential Management API)
+- Service Workers and Push Notifications
+
+When writing frontend code that needs clipboard, sharing, or crypto functionality, always use the non-secure fallback pattern. Do not use `navigator.clipboard.writeText()` or similar secure-context APIs.
+
 ## CI/CD Pipeline
 
 ### Infrastructure