feat(server): 工程骨架后端——上传 → 解析 → 清单最小链路

- core：配置（prod 拒绝默认密钥 / dev 短信 / 假模型）、租户事务 + 行级安全策略、
  problem+json 错误码、信封加密与签名下载、对象存储、事务内入队、Valkey stream 事件流、权限点
- identity：手机号 HMAC 存储、注册、登录（挤下线需确认，API3）、服务端会话
- billing：额度流水只追加，预扣 / 结算 / 退回，一笔预扣只有一个结局
- document：分片上传、按文件头识别格式、Gotenberg 转换、文字层与稳定句子编号
- checklist：标注规则识别、模型抽取、三道校验、标注类条款规则兜底、重跑对齐
- ai：提示词注册表（extract.substantive v1 来自 S4 v2）、假模型、OpenAI 兼容供应商、ai_call 流水
- 迁移：data-model 基线、套餐、Procrastinate、会话状态函数
- 测试 30 个：租户隔离、额度、失败退回、对象加密、契约一致性
- Compose（含 migrate）、镜像、CI

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/bid_doctor/notification/api.py

@@ -0,0 +1,57 @@
+from __future__ import annotations
+
+from typing import Annotated, Any
+
+from fastapi import APIRouter, Header
+from fastapi.responses import StreamingResponse
+from sqlalchemy import func, select
+
+from bid_doctor.core import events
+from bid_doctor.core.db import tenant_tx
+from bid_doctor.identity.deps import Ctx
+from bid_doctor.notification.models import Notification
+
+router = APIRouter(tags=["notifications"])
+
+
+@router.get("/events")
+async def stream_events(ctx: Ctx, last_event_id: Annotated[str | None, Header()] = None) -> StreamingResponse:
+    """SSE（API2：前端用 fetch 读，可以带 Bearer 头）。"""
+    return StreamingResponse(
+        events.stream(ctx.tenant_id, last_event_id),
+        media_type="text/event-stream",
+        headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+    )
+
+
+@router.get("/notifications")
+async def list_notifications(ctx: Ctx, unread: bool | None = None) -> dict[str, Any]:
+    async with tenant_tx(ctx) as s:
+        q = select(Notification).where(Notification.user_id == ctx.user_id)
+        if unread:
+            q = q.where(Notification.read_at.is_(None))
+        rows = (await s.execute(q.order_by(Notification.created_at.desc()).limit(50))).scalars().all()
+        n = (
+            await s.execute(
+                select(func.count())
+                .select_from(Notification)
+                .where(Notification.user_id == ctx.user_id, Notification.read_at.is_(None))
+            )
+        ).scalar_one()
+    titles = {"parse_succeeded": "招标文件解析完成", "parse_failed": "招标文件解析失败，额度已退回"}
+    return {
+        "unread_count": n,
+        "next_cursor": None,
+        "items": [
+            {
+                "id": r.id,
+                "kind": r.kind,
+                "title": titles.get(r.kind, r.kind),
+                "project_id": r.project_id,
+                "link": f"/projects/{r.project_id}/checklist" if r.project_id else None,
+                "read_at": r.read_at,
+                "created_at": r.created_at,
+            }
+            for r in rows
+        ],
+    }

server/src/bid_doctor/notification/models.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+from sqlalchemy import FetchedValue
+from sqlalchemy.orm import Mapped, mapped_column
+
+from bid_doctor.core.columns import PK, DbTs, Json, Ts, UuidCol
+from bid_doctor.core.db import Base
+
+
+class Notification(Base):
+    __tablename__ = "notification"
+    id: Mapped[PK]
+    tenant_id: Mapped[UuidCol]
+    user_id: Mapped[UuidCol]
+    kind: Mapped[str]
+    project_id: Mapped[UuidCol | None]
+    payload: Mapped[Json] = mapped_column(server_default=FetchedValue())
+    read_at: Mapped[Ts | None]
+    created_at: Mapped[DbTs]