see the real client IP behind ArvanCloud, and mark all notifications read in one call

Production is ArvanCloud -> nginx -> gunicorn, but NUM_PROXIES was 1, so DRF
took ArvanCloud's edge IP as the client: every guest and every OTP request
behind one edge shared a single throttle bucket (20 guest sessions an hour for
everyone). Default is now 2, and /api/health reports clientIp so the proxy
count can be checked from outside.

PATCH /api/notifications/read-all replaces the frontend's one-PATCH-per-item
loop, which spent the shared "read" budget 75 requests at a time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

notifications/urls.py

@@ -1,8 +1,9 @@
 from django.urls import path
 
-from .views import NotificationListView, NotificationMarkReadView
+from .views import NotificationListView, NotificationMarkAllReadView, NotificationMarkReadView
 
 urlpatterns = [
     path('notifications', NotificationListView.as_view(), name='notifications-list'),
+    path('notifications/read-all', NotificationMarkAllReadView.as_view(), name='notifications-mark-all-read'),
     path('notifications/<int:id>/read', NotificationMarkReadView.as_view(), name='notifications-mark-read'),
 ]