fix(notifications): suppress permission notifs when session auto-accepts

Server now mirrors client-side Permission Auto-Accept via
POST /api/notifications/auto-accept and short-circuits permission.asked
dispatch (walking the session parent chain). Prior 500ms debounce raced
the client auto-response and leaked notifications.

Also hint under Summarize Last Message that templates must contain
{last_message} for the setting to take effect.

packages/ui/src/components/sections/openchamber/NotificationSettings.tsx

@@ -786,6 +786,11 @@ export const NotificationSettings: React.FC = () => {
                   />
                   <span className="typography-ui-label text-foreground">Summarize Last Message</span>
                 </div>
+                <div className="pl-6 pb-1">
+                  <span className="typography-meta text-muted-foreground">
+                    Requires <code className="text-[var(--primary-base)]">{'{last_message}'}</code> in the notification template.
+                  </span>
+                </div>
 
                 <div className={cn("flex flex-col gap-2 py-1 sm:flex-row sm:items-center sm:gap-8")}>
                   <div className="flex min-w-0 flex-col sm:w-56 shrink-0">