List the signed-in user's in-app notifications

The top-bar bell and the /notifications page. One feed PER USER across every project the caller reaches, newest first, covering the last 30 days:

• kind=alert -- an alert rule FIRING or RESOLVED (the transitions its channels were sent; never a no-data transition), in every project where the caller holds READ on the rule provider's permission key: the observability plane for the alert-rules API's rules, budgets for a budget's alert; plus the alerts of a subscription-wide budget for a caller whose SUBSCRIPTION-level grant holds budgets READ -- such an item carries subscriptionId and a null projectId;
• kind=operation -- a FAILED operation the caller started, or one the operations feed shows the caller (reachable owning project + READ on the operation's resource plane). Read state is kept on the server per user: read on every item and unreadCount over the whole feed window (not only this page). unread=true lists only unread items. Every item names its region; region=<code> / region=global narrow the list. Errors: 401 no session; 422 invalid pagination. Idempotency/Concurrency: Safe; reading never changes read state.