feat: notification service

gateway/README.md

@@ -477,6 +477,26 @@ payload only: `user_id`, optional `device_session_id`, `event_type`,
 gateway derives `timestamp_ms`, recomputes `payload_hash`, signs the event,
 and only then forwards it to the matching `SubscribeEvents` streams.
 
+Notification-owned user-facing payloads are expected to use
+`pkg/schema/fbs/notification.fbs`. The initial notification event vocabulary
+in v1 is exactly:
+
+- `game.turn.ready`
+- `game.finished`
+- `lobby.application.submitted`
+- `lobby.membership.approved`
+- `lobby.membership.rejected`
+- `lobby.invite.created`
+- `lobby.invite.redeemed`
+
+`lobby.application.submitted` is published toward `Gateway` only for the
+private-game owner flow. The public-game variant is email-only.
+The real `Notification Service -> Gateway` integration suite verifies this
+user-targeted fan-out path and asserts that notification-owned push events do
+not include `device_session_id`, so Gateway delivers them to every active
+stream for the target user. Auth-code email does not use this push path and
+continues to bypass `Notification Service`.
+
 ## Verification and Routing Pipeline
 
 The gateway applies the same strict verification order for authenticated gRPC