docs(admin): on-site notifications, and the defaults page that was wrong

Engagement Phase 7 gives the platform a third notification channel — an inbox
on the site itself — so `notifications-and-email.mdx` gains a section for it:
what it is, that it is the one channel on by default, that its body is always
plain text, and that the nightly prune takes read items only.

Two corrections in the same file, both of which were already false before this
phase and would have become misleading with it:

- "Who receives what" said push was opt-OUT. Push stream subscriptions have
  always been opt-IN, and engagement Phase 3 made that explicit in the channel
  registry. Rewritten as three defaults plus the Team mute that overrides all
  three, and pointed at the preferences grid the same phase gave the web.
- `capabilities.mjs` claimed "Web, push and email … push arrives by default".
  The web channel did not exist until now and push has never arrived by
  default. Reworded to name the on-site inbox as the opt-out one.

The push section now says what a tickle raised by an engagement rule carries,
and that it is still only a pointer.

Code: RunicGateway/website#TBD · Docs: RunicGateway/docs#TBD

Co-Authored-By: Claude <noreply@anthropic.com>

src/content/docs/docs/administration/notifications-and-email.mdx

@@ -118,14 +118,41 @@ Two properties matter for what you have to trust:
 Without `NTFY_PUBLIC_URL` / `NTFY_ALLOWED_ORIGINS`, the app simply shows push as
 unavailable for your instance — nothing breaks.
 
+A tickle raised by an engagement rule carries a pointer to the matching item in the
+[on-site inbox](#on-site-notifications) where there is one, so the app opens on the thing
+that happened rather than on a list. It is still only a pointer: the content is fetched, not
+delivered.
+
+## On-site notifications
+
+The third way to reach somebody, and the only one that needs no relay, no mailbox and no
+app: an item in their **notification inbox** on the site itself. A bell in the header
+carries the unread count; the list lives at **Account → Notifications**.
+
+Two things are worth knowing before you enable a rule that uses it:
+
+- **It is the one channel that is on by default.** Push and email are opt-in — both reach
+  somebody somewhere else, so both have to be asked for. An inbox item is a row on a page
+  the person chose to open, so it is opt-*out*: they switch it off per notification under
+  Account → Notifications → Settings.
+- **The body is plain text, always.** The in-app template renders through the same block
+  editor as your mail, but only the text of each block is stored, so nothing an operator
+  writes can become markup on somebody else's page. Links are site-relative or dropped.
+
+Old, read items are pruned nightly (90 days by default). **Unread items are never pruned** —
+an inbox that quietly deleted things nobody had seen would make the unread badge meaningless.
+
 ## Who receives what
 
-The per-person side of this lives in the player portal, not the admin panel: each member
+The per-person side of this lives in the player portal, not the admin panel: **Account →
-chooses which Team and forum notifications they want, and how. Two defaults are worth
+Notifications → Settings** is a grid of every notification against every channel, and each
-knowing because they are not symmetrical:
+member sets their own. The defaults are not symmetrical, and the asymmetry is deliberate:
 
-- **Push is opt-out** once a device is registered.
 - **Email is opt-in.**
+- **Push is opt-in.**
+- **On the site is opt-out** — see above.
+- **Muting a Team silences all three for that Team**, whatever the grid says, without
+  touching any of their other Teams.
 
 <Aside type="caution" title="Nothing here retries">
 The announcement dispatcher sends once, and the Team notification bridge states plainly that

src/data/capabilities.mjs

@@ -139,9 +139,9 @@ const community = {
     {
       label: 'Notifications',
       detail:
-        'Web, push and email, chosen per stream by each person rather than per person by ' +
+        'On the site, by push and by email, chosen per notification by each person rather ' +
-        'you. Push arrives by default and can be switched off; email only ever arrives if ' +
+        'than per person by you. The on-site inbox arrives by default and can be switched ' +
-        'it was asked for.',
+        'off; push and email only ever arrive if they were asked for.',
     },
     {
       label: 'Wiki',