feat: push notifications on each device (Web Push)

- What reaches the bell also reaches the devices where the person
  turned «Avisos en este dispositivo» on, with TaskStream closed: the
  Notifier sends each new notification encrypted (aes128gcm) and signed
  with VAPID, and forgets subscriptions the push service dropped
  (404/410). A failure never blocks the event stream.
- The API keeps one subscription per device (push_subscriptions) and
  exposes the VAPID public key in the notification settings; GraphQL
  subscribePush/unsubscribePush, REST /me/push-subscriptions. Without
  VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off.
- The web registers /push-sw.js, a service worker that only shows the
  notification and opens its ticket on a tap (no caching, served
  without cache by nginx), and a manifest that makes it installable,
  which iPhones need for push.
- The bell's toggles show their text next to them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/schema.gql

@@ -772,6 +772,9 @@ type Mutation {
   """Start a planned sprint (only one under way per project)"""
   startSprint(sprintId: ID!): CommandResult!
 
+  """Push on this device"""
+  subscribePush(subscription: PushSubscriptionInput!): Boolean!
+
   """Send a ping now and tell how it went"""
   testWebhook(webhookId: ID!): WebhookDelivery!
 
@@ -781,6 +784,9 @@ type Mutation {
   trashIssue(issueId: ID!): CommandResult!
   unlinkIssues(input: LinkIssuesInput!): CommandResult!
 
+  """Push off on this device"""
+  unsubscribePush(endpoint: String!): Boolean!
+
   """Stop following a ticket"""
   unwatchIssue(issueId: ID!): CommandResult!
 
@@ -859,6 +865,11 @@ type NotificationSettings {
 
   """Whether this installation can send e-mail at all"""
   emailAvailable: Boolean!
+
+  """
+  VAPID public key to subscribe a device to push with; null: no push here
+  """
+  pushPublicKey: String
 }
 
 type Project {
@@ -980,6 +991,13 @@ type ProjectStats {
   total: Int!
 }
 
+"""A browser's Web Push subscription (PushSubscription.toJSON())"""
+input PushSubscriptionInput {
+  auth: String!
+  endpoint: String!
+  p256dh: String!
+}
+
 type QaStats {
   failed: Int!
   failureRate: Float