Seed default AI settings and notification preferences at boot

On first boot create the ai_settings row (provider anthropic, empty base
URL, model and key, temperature 0.7, system prompt DefaultPersonaPrompt
from CTXD PROMPTS.MD §4) and a notification_prefs row per event (push on
for all five, chat on for plan_ready and list_ready only). Existing rows
are never changed; a missing event row is seeded on its own.

cmd/server seeds household settings, AI settings and notification
preferences through seedDefaults; any failure stops the boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/server/main.go

@@ -59,7 +59,7 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		}
 	}()
 
-	if err := seedSettings(ctx, db, cfg.DefaultTZ); err != nil {
+	if err := seedDefaults(ctx, db, cfg.DefaultTZ); err != nil {
 		return err
 	}
 	settings := household.NewSettingsService(db)
@@ -153,6 +153,18 @@ func seedSettings(ctx context.Context, db *store.Store, defaultTZ string) error
 	return err
 }
 
+// seedDefaults creates the household settings, AI settings and notification
+// preferences that do not exist yet. Existing rows are never changed.
+func seedDefaults(ctx context.Context, db *store.Store, defaultTZ string) error {
+	if err := seedSettings(ctx, db, defaultTZ); err != nil {
+		return err
+	}
+	if err := household.SeedAISettings(ctx, db); err != nil {
+		return err
+	}
+	return household.SeedNotificationPrefs(ctx, db)
+}
+
 // logListening logs the startup line. Only the public URL's origin is logged
 // so no credential-bearing URL component can reach the log.
 func logListening(logger *slog.Logger, cfg config.Config) {