L6 Benachrichtigungen & Audit: Glocke, Posteingang, Nutzer-Einstellungen, Mailkonfiguration

- Glocke im Backoffice-Header (ungelesen-Zähler, letzte 10, alle gelesen), mobil
  einbindbar über variant="mobile".
- /notifications mit Filter gelesen/ungelesen/Art, Öffnen markiert gelesen (nur
  relative Links), Pagination.
- /account Abschnitt Benachrichtigungen: E-Mail-Opt-out je Typ, Notdienst Pflicht.
- /settings/email (tenant:manage): Absendername, Antwortadresse, Empfänger Notdienst
  und Abrechnung; Validierung gegen Header-Injection, max. 20 Adressen, Audit.
- Actions unter actions/notifications mit moduleGuard + guard; Navigation ergänzt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/lib/nav.ts

@@ -8,6 +8,9 @@ import {
   FileText,
   FolderOpen,
   Settings,
+  Bell,
+  History,
+  Mail,
   type LucideIcon,
 } from "lucide-react";
 import type { ModuleKey } from "@/lib/modules";
@@ -49,7 +52,10 @@ export const NAV_ITEMS: readonly NavItem[] = [
   { href: "/teams", label: "teams", icon: UsersRound, module: "teams", permissions: ["team:read"], section: "main" },
   { href: "/reports", label: "reports", icon: FileText, module: "reports", permissions: ["report:read"], section: "main" },
   { href: "/documents", label: "documents", icon: FolderOpen, module: "documents", permissions: ["document:read"], section: "main" },
+  { href: "/notifications", label: "notifications", icon: Bell, module: "notifications", permissions: ["notification:read"], section: "main" },
   { href: "/settings", label: "settings", icon: Settings, permissions: ["tenant:manage"], section: "admin" },
+  { href: "/settings/email", label: "email", icon: Mail, module: "notifications", permissions: ["tenant:manage"], section: "admin" },
+  { href: "/settings/audit", label: "audit", icon: History, permissions: ["audit:read"], section: "admin" },
 ];
 
 /** Filtert die Navigation nach aktiven Modulen und Rechten der Session. */