feat(notify): web push as a notification channel

- VAPID keys from VAPID_* or generated once (push_keys, migration 9);
  devices in push_subscriptions, forgotten on 404/410 from the push service
- push column for every event (also due tasks) and the daily summary,
  bundles as one notification; /push/key, /devices, /subscribe,
  /unsubscribe, /test
- settings: switch push on per device, test it, see the devices; the
  service worker shows notifications and focuses MindSift on click
- tests decrypt a sent push like a browser (RFC 8291) and check VAPID

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/features/settings/__tests__/UserSettingsView.alarms.test.tsx

@@ -13,6 +13,7 @@ vi.mock('../../../lib/api', async () => {
       ...actual.api,
       getMe: vi.fn(async () => ({ isLastAdmin: false })),
       getAuthStatus: vi.fn(async () => ({ demoMode: false })),
+      getPushDevices: vi.fn(async () => []),
       updateSettings: vi.fn(async (patch) => ({ ...baseUser, ...patch })),
     },
   };
@@ -88,10 +89,10 @@ describe('UserSettingsView notification matrix', () => {
           paused: true,
           includeOwnWatched: true,
           events: {
-            due: { email: true, discord: true, webhook: false },
-            shared: { email: true, discord: false, webhook: false },
-            taskDone: { email: true, discord: false, webhook: false },
-            watched: { email: true, discord: false, webhook: false },
+            due: { email: true, discord: true, webhook: false, push: false },
+            shared: { email: true, discord: false, webhook: false, push: false },
+            taskDone: { email: true, discord: false, webhook: false, push: false },
+            watched: { email: true, discord: false, webhook: false, push: false },
           },
           dailySummary: {
             enabled: true,
@@ -99,6 +100,7 @@ describe('UserSettingsView notification matrix', () => {
             email: true,
             discord: true,
             webhook: false,
+            push: false,
           },
         },
       })