Capture the M7 backend/docs breakdown in PLAN.md before the code lands: two event sources / one publisher, the stream catalog + PUBLIC_KINDS-gated mapping, push_devices + notification_subscriptions tables, the /auth/me routes, the SSRF endpoint guard, and the content-free-tickle ntfy service (no publish token). Co-Authored-By: Claude <noreply@anthropic.com>