fix(admin): wipe-all-data clears notification channels, push subs, telegram deletions

The "Wipe all data" admin transaction was scoped only to measurements,
medications, intakes, API tokens, Withings connections, and auth
challenges. Notification channels (encrypted Telegram bot tokens in
NotificationChannel.config), Web Push subscriptions, and queued
Telegram message deletions survived the wipe — a scope leak first
flagged in the v1.4.6 multi-agent QA pass.

Extends the transaction with `notificationChannel.deleteMany`,
`pushSubscription.deleteMany`, and `telegramScheduledDeletion.deleteMany`.
NotificationPreference rows cascade via the schema FK.

Feedback rows are intentionally preserved (T8 v1.4.6) and the i18n
copy now states this explicitly so admins know bug reports survive a
wipe. Counts for the three new tables are returned to the UI.

Adds an integration regression test that seeds all three tables,
invokes the route handler with a real admin session, and asserts the
wipe clears them while Feedback + AuditLog survive.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/admin/data/route.ts

@@ -56,6 +56,15 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
     const withingsConnections = await tx.withingsConnection.deleteMany({});
     const authChallenges = await tx.authChallenge.deleteMany({});
 
+    // v1.4.6 left these out, so encrypted Telegram bot tokens
+    // (NotificationChannel.config) and Web Push endpoints survived a
+    // wipe. Cascading via NotificationPreference is handled by the
+    // schema's onDelete: Cascade on the channel FK.
+    const notificationChannels = await tx.notificationChannel.deleteMany({});
+    const pushSubscriptions = await tx.pushSubscription.deleteMany({});
+    const telegramScheduledDeletions =
+      await tx.telegramScheduledDeletion.deleteMany({});
+
     await tx.user.updateMany({
       data: {
         heightCm: null,
@@ -80,6 +89,9 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
       apiTokens: apiTokens.count,
       withingsConnections: withingsConnections.count,
       authChallenges: authChallenges.count,
+      notificationChannels: notificationChannels.count,
+      pushSubscriptions: pushSubscriptions.count,
+      telegramScheduledDeletions: telegramScheduledDeletions.count,
     };
   });