Shop notifications: who hears about an order or an import, and when.

Sends go through core's notification layer, so each recipient's own per-type preferences and delivery channels (in-app inbox, email, Telegram, digest cadence) apply. This module only decides the audience and the copy.

Recipients

admin_recipients/0 unions three sources, because no single one is complete:

• holders of the relevant permission key (users_with_permission/1)
• Owner-role holders, whose access is implicit and who therefore have no permission rows at all
• holders of the "*" superadmin key, likewise absent from a key-specific query

A resolver that queried only the first would miss the primary operator of a default install — the person most likely to want the notification.

Failure is never fatal

Every send is wrapped: a notification is a message about a committed fact, and must not be able to undo it. Order placement in particular runs this after the conversion transaction commits.