Profile subscription + /management/notify endpoint (closes #77)

[ClaydeCode]

Summary

• Add Profile.subscription: ShardSubscriptionSummary | None; Profile.from_shard populates it from the shard payload.
• portal_controller.refresh_profile now validates /shards/self as ShardResponse (the actual API contract), so subscription data flows through.
• New POST /core/management/notify endpoint: body {"type": str}, broadcasts via ws_worker.broadcast_message(type). Broadcast errors are logged, not propagated (web-terminal may be disconnected). Returns 204. Auth is the existing /management/* shared-secret forward-auth via Traefik.
• just get-types synced: pulls in subscription_model.py plus ShardSubscriptionSummary, expanded VmSize ordering, ShardResponse.subscription, and other minor model drift from controller PRs #248/#249.

Recommended reading order

1. shard_core/data_model/backend/ — synced types from controller (foundation, includes ShardSubscriptionSummary and subscription_model.py).
2. shard_core/data_model/profile.py — Profile.subscription + from_shard change.
3. shard_core/service/portal_controller.py — validate /shards/self response as ShardResponse.
4. shard_core/web/management/notify.py — new endpoint.
5. shard_core/web/management/__init__.py — wire notify router in.
6. tests/conftest.py — _shard_self_response_body helper + subscription kwarg on requests_mock_context.
7. tests/test_profile.py — subscription-present and subscription-absent assertions.
8. tests/test_notify.py — broadcast called with payload, broadcast errors swallowed, missing type → 422.

Test plan

• tests/test_profile.py — subscription present/absent
• tests/test_notify.py — happy path, error swallowed, 422 on missing field
• tests/test_signed_call.py, tests/test_terminals.py — still green (mock change verified)
• .venv/bin/ruff check . clean
• Manual: controller → shard /core/management/notify round-trip (covered by web-terminal upadate freeshard controller types and make startup more robust #20 follow-up)

Note: tests/test_management_endpoint.py::test_install_app fails in this sandbox because docker-compose (legacy v1 binary) is not installed; only docker compose v2 is available. Pre-existing env issue, unrelated to this PR.

🤖 Generated with Claude Code