Fix admin notifications for profile review requests

[dongmucat]

修复内容

• 当用户昵称/资料变更进入人工审核时，发布资料审核通知，管理员可在通知列表看到 PROFILE_REVIEW_SUBMITTED。
• 通知复用 REVIEW category，收件人限定为 USER_ADMIN / SUPER_ADMIN，避免发给无资料审核权限的 SKILL_ADMIN。
• 资料审核通知跳转到 /dashboard/reviews?type=profile，管理员点击后进入资料审核队列，而不是技能审核详情页。
• 通知 payload 不包含待审核昵称等敏感变更值，仅保留 profileReviewId、submitterId、fields 等必要字段。
• 修复 /api/web/notifications/sse 被响应缓存截断的问题，保持 SSE 长连接，并恢复实时 notification event 与实时未读 badge 推送。
• 同步更新前端路由/tab 处理、OpenAPI/generated schema 和相关测试。

验证结果

• make test-backend-app
• make typecheck-web
• make lint-web
• scripts/check-openapi-generated.sh
• pnpm exec vitest run src/pages/dashboard/reviews.test.ts
• pnpm exec vitest run src/features/notification/notification-target.test.ts
• 本地 SSE curl 验证：/api/web/notifications/sse 返回 Transfer-Encoding: chunked，无 Content-Length，客户端超时前连接保持打开。
• 真人路径复测通过：资料审核通知生成、未读数、SSE 实时推送、通知铃铛实时更新、点击跳转、权限隔离、技能审核通知和通知分类 tab 回归均正常。
• GitHub checks: DCO, CLA, Docs Build, Server Unit Tests, Web Build And Test, E2E (Real Services)

Fixes #524

[dongmucat]

Code review finding (blocking): NotificationController returns /dashboard/reviews/{id} for PROFILE_REVIEW_SUBMITTED notifications, but the existing frontend route dashboard/reviews/$id is the skill-review detail page. That page calls the skill review detail hooks for the route id, so clicking a profile-review notification will open the wrong workflow: either a skill review with the same numeric id or a skill-review not-found page. It does not take the admin to the profile review queue/action UI, so ISSUE-51's notification-list review path is still broken.

Please change the target contract to a route the current frontend can handle for profile reviews, or include the needed frontend route/search handling in this PR. The API docs and tests should assert that PROFILE_REVIEW_SUBMITTED targets the actual profile-review UI, not the skill-review detail route.

Verification I ran locally:

• git diff --check origin/main...HEAD passed.
• make test-backend-app passed: 529 tests, 0 failures, 0 errors, 0 skipped.

Also noted: current GitHub checks still show DCO failing and E2E pending, so the PR cannot be merge-ready yet even apart from the routing issue.

Note: I attempted to submit this as a formal “request changes” review, but GitHub rejected it because the authenticated GitHub user is the PR author.