feat: notification service

geoprofile/PLAN.md

@@ -297,9 +297,10 @@ Goal:
 
 Tasks:
 
-- Define the event payload for `country_review_recommended=true`.
-- Implement event publication on transition to `true`.
-- Implement configuration-driven notification handoff through
+- Define the normalized notification-intent payload for
+  `geo.review_recommended`.
+- Implement intent publication on transition to `true`.
+- Implement configuration-driven administrator-notification handoff through
   `Notification Service`.
 - Add notification deduplication or transition-only logic to prevent spam.
 - Add failure metrics for both event publication and downstream notification

geoprofile/README.md

@@ -806,10 +806,21 @@ Notification routing is triggered only when:
 - `country_review_recommended` transitions to `true`
 - Email notifications are enabled
 
-`Notification Service` may then fan out e-mail delivery through
-`Mail Service`.
+`Geo Profile Service` publishes normalized notification intent
+`geo.review_recommended` into `notification:intents` with
+`audience_kind=admin_email`.
+Go implementations should use the shared `galaxy/notificationintent` module
+for this publication path.
+`Notification Service` then resolves the administrator email list from its own
+configuration and fans out e-mail delivery through `Mail Service`.
 Geo Profile Service itself never sends mail directly.
-That path is auxiliary and must not be required for business correctness.
+This path is unrelated to auth-code delivery, which remains a direct
+`Auth / Session Service -> Mail Service` flow and bypasses
+`Notification Service`.
+That path is auxiliary and must not be required for business correctness. If
+the notification intent append fails after the review state transition is
+stored, the transition remains committed and the failure is handled as
+notification degradation.
 
 ## Event Bus Integration