fix(notifications): log every refused notification answer

A quick answer whose request never reached the route left no trace: a
redirect in front of the app turns ntfy's POST into a GET, which Next
answered 405 before any wide event, and the worker-only and demo-mode
refusals in the proxy wrote nothing either. The proxy now answers a
non-POST on the action path itself with 405 and Allow: POST, and every
refusal it makes there writes one warn line with a reason and the path
without its token. The route's rate-limit refusal carries a reason too.

The regression test sends the action ntfy publishes, in the shape ntfy
sends it, through the real proxy and route against Postgres.

Refs #1203

src/app/api/notifications/action/[token]/route.ts

@@ -71,6 +71,10 @@ export const POST = apiHandler(
       RATE_WINDOW_MS,
     );
     if (!rl.allowed) {
+      annotate({
+        action: { name: "notification.action.refused" },
+        meta: { reason: "rate_limited" },
+      });
       const response = apiError("Too many requests", 429);
       for (const [k, v] of Object.entries(rateLimitHeaders(rl))) {
         response.headers.set(k, v);