Add HSTS, gzip, Ntfy notifications, and paginate entries endpoint

- nginx: add HSTS (max-age=31536000) and gzip for text/css/js/json
- entries: add limit/offset query params (default 200, max 1000)
- Ntfy: wire NTFY_URL/NTFY_TOKEN through env; notify on startup, new
  registration, admin login, user disable, and user delete
- httpx==0.28.1 added for async Ntfy HTTP calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/auth.py

@@ -10,6 +10,7 @@ from app.limiter import limiter
 from app.models.user import User
 from app.schemas.user import UserCreate, Token, LoginRequest
 from app.utils.security import hash_password, verify_password, create_token
+from app.utils.notify import notify
 
 logger = logging.getLogger("bourbonacci.auth")
 router = APIRouter(prefix="/api/auth", tags=["auth"])
@@ -36,6 +37,7 @@ async def register(request: Request, body: UserCreate, db: AsyncSession = Depend
     await db.refresh(user)
 
     logger.info("New user registered: %s", body.email)
+    await notify("New registration", f"User registered: {body.email}", priority="default")
     return Token(access_token=create_token(user.id))
 
 
@@ -54,4 +56,6 @@ async def login(request: Request, body: LoginRequest, db: AsyncSession = Depends
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Account disabled")
 
     logger.info("Login: %s (id=%s)", body.email, user.id)
+    if user.is_admin:
+        await notify("Admin login", f"Admin login: {body.email}", priority="high")
     return Token(access_token=create_token(user.id))