Notifications, privacy reports & API costs dashboard

What's new

• Notifications inbox — new bell icon in the dashboard header surfaces change-request approvals, score changes, policy updates, and flagged vendors. Daily or weekly email digest, plus granular per-type preferences.
• Privacy Report PDF — one-click branded export for claimed companies. Cover page, executive summary, score breakdown, subprocessors, international transfers, AI practices. Stored in S3 and re-downloadable from the Reports tab.
• API Costs dashboard — new /admin/api-costs page with stat cards, daily trend, per-service / per-model / per-operation breakdown, and a pricing catalog with OpenRouter sync. Historical recalc command included.

Improvements

• Gemini cost calculation now uses the correct provider rates (previously misreported as OpenAI).
• extract_policy_dates uses a regex fast-path before falling back to AI — 94% token reduction on that operation.
• Per-operation token budgets for data purposes, retention, transfers, and deletion difficulty (40–98% reduction).

Fixes

• TypeScript errors breaking Forge deployment.
• Admin tab crash when cost_usd arrived as a Laravel decimal cast string.