feat(notify): web push as a notification channel

- VAPID keys from VAPID_* or generated once (push_keys, migration 9);
  devices in push_subscriptions, forgotten on 404/410 from the push service
- push column for every event (also due tasks) and the daily summary,
  bundles as one notification; /push/key, /devices, /subscribe,
  /unsubscribe, /test
- settings: switch push on per device, test it, see the devices; the
  service worker shows notifications and focuses MindSift on click
- tests decrypt a sent push like a browser (RFC 8291) and check VAPID

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/migrations.go

@@ -29,6 +29,7 @@ var migrations = []migration{
 	{6, "Link-Vorschauen", (*Store).migrateLinkPreviews},
 	{7, "Benachrichtigungen", (*Store).migrateNotifications},
 	{8, "Journal", (*Store).migrateJournal},
+	{9, "Web-Push", (*Store).migratePush},
 }
 
 func (s *Store) migrate() error {