Merge pull request 'docs(admin): on-site notifications, and the defaults page that was wrong' (#24) from docs/engagement-inapp-channel into edge

Reviewed-on: #24

src/content/docs/docs/administration/notifications-and-email.mdx

@@ -118,14 +118,41 @@ Two properties matter for what you have to trust:
 Without `NTFY_PUBLIC_URL` / `NTFY_ALLOWED_ORIGINS`, the app simply shows push as
 unavailable for your instance — nothing breaks.
 
+A tickle raised by an engagement rule carries a pointer to the matching item in the
+[on-site inbox](#on-site-notifications) where there is one, so the app opens on the thing
+that happened rather than on a list. It is still only a pointer: the content is fetched, not
+delivered.
+
+## On-site notifications
+
+The third way to reach somebody, and the only one that needs no relay, no mailbox and no
+app: an item in their **notification inbox** on the site itself. A bell in the header
+carries the unread count; the list lives at **Account → Notifications**.
+
+Two things are worth knowing before you enable a rule that uses it:
+
+- **It is the one channel that is on by default.** Push and email are opt-in — both reach
+  somebody somewhere else, so both have to be asked for. An inbox item is a row on a page
+  the person chose to open, so it is opt-*out*: they switch it off per notification under
+  Account → Notifications → Settings.
+- **The body is plain text, always.** The in-app template renders through the same block
+  editor as your mail, but only the text of each block is stored, so nothing an operator
+  writes can become markup on somebody else's page. Links are site-relative or dropped.
+
+Old, read items are pruned nightly (90 days by default). **Unread items are never pruned** —
+an inbox that quietly deleted things nobody had seen would make the unread badge meaningless.
+
 ## Who receives what
 
-The per-person side of this lives in the player portal, not the admin panel: each member
+The per-person side of this lives in the player portal, not the admin panel: **Account →
-chooses which Team and forum notifications they want, and how. Two defaults are worth
+Notifications → Settings** is a grid of every notification against every channel, and each
-knowing because they are not symmetrical:
+member sets their own. The defaults are not symmetrical, and the asymmetry is deliberate:
 
-- **Push is opt-out** once a device is registered.
 - **Email is opt-in.**
+- **Push is opt-in.**
+- **On the site is opt-out** — see above.
+- **Muting a Team silences all three for that Team**, whatever the grid says, without
+  touching any of their other Teams.
 
 <Aside type="caution" title="Nothing here retries">
 The announcement dispatcher sends once, and the Team notification bridge states plainly that

src/data/capabilities.mjs

@@ -139,9 +139,9 @@ const community = {
     {
       label: 'Notifications',
       detail:
-        'Web, push and email, chosen per stream by each person rather than per person by ' +
+        'On the site, by push and by email, chosen per notification by each person rather ' +
-        'you. Push arrives by default and can be switched off; email only ever arrives if ' +
+        'than per person by you. The on-site inbox arrives by default and can be switched ' +
-        'it was asked for.',
+        'off; push and email only ever arrive if they were asked for.',
     },
     {
       label: 'Wiki',