Portfolio Notifications API

Used by the Portfolio LTI tool to emit a Canvas notification for a recipient user. This does not persist a domain record; it dispatches the shared "Portfolio Event" notification through the standard pipeline (respecting the recipient's /profile/communication preferences and daily/weekly digest for the "Portfolio" category), carrying the per-event copy in the message data hash -- the same approach other data-only notifications (e.g. 2fa) use.

The notification is recipient-scoped, not course-scoped. Authorization is a shared-context check: the caller may only notify someone Canvas already considers messageable from them (they share a course/group) -- the same rule Conversations uses to decide who you can message.