feat(notify): Cancel button on Windows toasts via the talk: protocol handler

Windows toasts cannot call back into the daemon, so the Cancel button opens
a talk: link instead: `talk:cancel?id=<id>&port=<port>`. The daemon
registers the talk: URL protocol for the current user (HKCU, no admin) and
points it at `talk uri "%1"`; Windows starts that on the click, and `talk
uri` posts to the new endpoint POST /cancel-item, which cancels only the
announcement with that id (queue.CancelItem). The toast is tagged and
removed again when the announcement ends. For now the toast is shown under
Windows PowerShell's app identity, which unpackaged programs can use
without a Start Menu shortcut.

Verified on the Windows 11 VM: registry entry written by the daemon,
Start-Process "talk:cancel?id=…&port=7800" (what the button does) stops
the playing announcement within two seconds, no toast errors in the log.

Tests: `talk uri` against a real handler on a loopback port (playing vs
waiting id, dead daemon, talk:test, garbage links), POST /cancel-item
process test (only the playing item, waiting one plays next, 400 without
id).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

test/harness_test.go

@@ -535,3 +535,18 @@ func mcpDecode(t *testing.T, raw rawResponse) map[string]any {
 	}
 	return m
 }
+
+// postJSON POSTs a JSON body to a daemon endpoint and decodes the reply.
+func postJSON(t *testing.T, d *daemonProc, path, body string) (int, map[string]any) {
+	t.Helper()
+	resp, err := http.Post(d.baseURL+path, "application/json", strings.NewReader(body))
+	if err != nil {
+		t.Fatalf("POST %s: %v", path, err)
+	}
+	defer resp.Body.Close()
+	var m map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&m); err != nil {
+		t.Fatalf("decoding POST %s reply: %v", path, err)
+	}
+	return resp.StatusCode, m
+}