Expose read-only in-app notification details at GET /notifications/:id with owner scoping and list-all admin access. Co-authored-by: Cursor <cursoragent@cursor.com>
