Spotlight Location Notifications

[3TTemi]

Summary

This pull request adds location-based spotlight notifications using native geofencing.

• Backend SpotlightModule with service, controller, and WebSocket gateway for full CRUD and notification delivery
• Multi-layer anti-spam: daily cap (1/day), per-spotlight cooldown (configurable, default 7 days), time window filtering (Eastern Time), and completion-aware filtering (skips users who already completed linked challenge/event)
• Dedicated HTTP POST endpoint (spotlight/notify) for background geofence callbacks (cannot use WebSocket from background isolate)
• Server-side proximity verification using distance calculation (extracted to shared geo.util.ts)
• New Prisma models: LocationSpotlight and SpotlightNotificationLog
• Flutter SpotlightService — fetches active spotlights via WebSocket every 15 min, registers OS-level geofences via native_geofence, works with app closed
• Android/iOS native geofencing permissions and manifest setup
• Admin UI Spotlights.tsx — full CRUD for managing spotlights with geographic coords, radius, time windows, date ranges, and optional challenge/event linking

Test Plan

• Unit tests for anti-spam rules in the servers `SpotlightService'
• Manual testing for closed and open app: create a spotlight in admin, walk into geofence radius, verify notification fires on device

Notes

• Geofence callbacks run in a separate OS background process (Dart isolate) that cannot access WebSocket state — this is why notifications use a dedicated HTTP endpoint instead of the WebSocket gateway
• The native_geofence Flutter plugin requires "Always Allow" location permission for background geofencing
• Anti-spam cooldown and time windows use Eastern Time (America/New_York)

[dti-github-bot]

[diff-counting] Significant lines: 3433. This diff might be too big! Developer leads are invited to review the code.