feat(notify): web push as a notification channel

- VAPID keys from VAPID_* or generated once (push_keys, migration 9);
  devices in push_subscriptions, forgotten on 404/410 from the push service
- push column for every event (also due tasks) and the daily summary,
  bundles as one notification; /push/key, /devices, /subscribe,
  /unsubscribe, /test
- settings: switch push on per device, test it, see the devices; the
  service worker shows notifications and focuses MindSift on click
- tests decrypt a sent push like a browser (RFC 8291) and check VAPID

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config.go

@@ -54,6 +54,11 @@ type Config struct {
 
 	// NotifyDigestMinutes: notifications (except task alarms) are bundled over this many minutes
 	NotifyDigestMinutes int
+
+	// Web push (VAPID_*): keys are generated and stored in the database when not set
+	VAPIDPublicKey  string
+	VAPIDPrivateKey string
+	VAPIDSubject    string
 }
 
 // MediaConfig limits uploads of images and audio recordings in notes. Sizes in MB; QuotaMB 0 = no limit
@@ -241,6 +246,9 @@ func Load() *Config {
 			TimeoutSeconds: envInt("STT_TIMEOUT_SECONDS", 120, 5, 3600),
 		},
 		NotifyDigestMinutes: envInt("NOTIFY_DIGEST_MINUTES", 5, 1, 1440),
+		VAPIDPublicKey:      strings.TrimSpace(os.Getenv("VAPID_PUBLIC_KEY")),
+		VAPIDPrivateKey:     strings.TrimSpace(os.Getenv("VAPID_PRIVATE_KEY")),
+		VAPIDSubject:        strings.TrimSpace(os.Getenv("VAPID_SUBJECT")),
 		Media: MediaConfig{
 			MaxImageMB: envInt("MEDIA_MAX_IMAGE_MB", 15, 1, 1000),
 			MaxAudioMB: envInt("MEDIA_MAX_AUDIO_MB", 50, 1, 2000),