feat(push-gateway,msg): redis pubsub backplane for real-time notifications

M7: ADR-040 Redis Pub/Sub as state routing backplane

- push-gateway: remove Kafka consumer, add SSE endpoint

- SSE: subscribe to Redis user:{userId}:notify on connect

- msg: publish notifications to Redis Pub/Sub instead of HTTP push

- docker-compose: remove Kafka env from push-gateway

infra/docker-compose.deploy.yml

@@ -294,11 +294,9 @@ services:
     environment:
       PUSH_GATEWAY_PORT: 8081
       JWT_SECRET: ${JWT_SECRET}
+      # M7 (ADR-040): Redis Pub/Sub backplane for real-time push.
+      # push-gateway no longer mounts Kafka directly.
       REDIS_URL: ${REDIS_URL}
-      KAFKA_BROKERS: ${KAFKA_BROKERS:-kafka:29092}
-      # ARB-013 canonical topic name (v2 alignment with msg Outbox publisher).
-      KAFKA_NOTIFICATION_TOPIC: edu.notify.notification.sent
-      KAFKA_CONSUMER_GROUP: push-gateway
       # PUSH_INTERNAL_TOKEN is the canonical env var (ARB-013 alignment with
       # msg). INTERNAL_API_TOKEN kept as backward-compat alias.
       PUSH_INTERNAL_TOKEN: ${PUSH_INTERNAL_TOKEN:-${INTERNAL_API_TOKEN:-edu-internal-token}}