feat(notify): web push as a notification channel

- VAPID keys from VAPID_* or generated once (push_keys, migration 9);
  devices in push_subscriptions, forgotten on 404/410 from the push service
- push column for every event (also due tasks) and the daily summary,
  bundles as one notification; /push/key, /devices, /subscribe,
  /unsubscribe, /test
- settings: switch push on per device, test it, see the devices; the
  service worker shows notifications and focuses MindSift on click
- tests decrypt a sent push like a browser (RFC 8291) and check VAPID

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server.go

@@ -39,6 +39,9 @@ type Server struct {
 	notifyEmailHook   func(to, subject, text, html string) error
 	notifyDiscordHook func(webhookURL, heading string, items []notifyItem) error
 	notifyWebhookHook func(webhookURL, heading string, items []notifyItem) error
+	notifyPushHook    func(userID string, msg pushMessage) error
+	pushHTTPClient    *http.Client // tests: reach a local push service
+	push              pushKeys
 }
 
 func NewServer(cfg *config.Config, store *storage.Store, wsHub *ws.Hub, staticFS fs.FS) *Server {
@@ -218,6 +221,11 @@ func (s *Server) Router() http.Handler {
 		r.Put("/api/v1/workspace/tags/{tag}/note", s.handleUpdateTagPageNote)
 
 		r.Get("/api/v1/journal", s.handleGetJournal)
+		r.Get("/api/v1/push/key", s.handlePushKey)
+		r.Get("/api/v1/push/devices", s.handlePushDevices)
+		r.Post("/api/v1/push/subscribe", s.handlePushSubscribe)
+		r.Post("/api/v1/push/unsubscribe", s.handlePushUnsubscribe)
+		r.Post("/api/v1/push/test", s.handlePushTest)
 		r.Post("/api/v1/journal/{date}", s.handleOpenJournalDay)
 		r.Get("/api/v1/documents", s.handleGetDocuments)
 		r.Post("/api/v1/documents", s.handleCreateDocument)