feat: push notifications on each device (Web Push)

- What reaches the bell also reaches the devices where the person
  turned «Avisos en este dispositivo» on, with TaskStream closed: the
  Notifier sends each new notification encrypted (aes128gcm) and signed
  with VAPID, and forgets subscriptions the push service dropped
  (404/410). A failure never blocks the event stream.
- The API keeps one subscription per device (push_subscriptions) and
  exposes the VAPID public key in the notification settings; GraphQL
  subscribePush/unsubscribePush, REST /me/push-subscriptions. Without
  VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off.
- The web registers /push-sw.js, a service worker that only shows the
  notification and opens its ticket on a tap (no caching, served
  without cache by nginx), and a manifest that makes it installable,
  which iPhones need for push.
- The bell's toggles show their text next to them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/nginx.conf

@@ -28,6 +28,19 @@ server {
     proxy_read_timeout 1h;
   }
 
+  # The service worker and the manifest have no hash in their name: never
+  # cached, or browsers would keep an old one (exact matches win over the
+  # regex below).
+  location = /push-sw.js {
+    add_header Cache-Control "no-cache";
+    try_files $uri =404;
+  }
+  location = /manifest.webmanifest {
+    add_header Cache-Control "no-cache";
+    default_type application/manifest+json;
+    try_files $uri =404;
+  }
+
   # Hashed bundles can be cached forever; index.html never.
   location ~* \.(js|css|woff2?|svg|png|ico)$ {
     expires 1y;

apps/web/public/manifest.webmanifest

@@ -0,0 +1,25 @@
+{
+  "name": "TaskStream",
+  "short_name": "TaskStream",
+  "description": "Gestión de proyectos y tickets en tiempo real",
+  "lang": "es",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#f7f7fa",
+  "theme_color": "#a347e1",
+  "icons": [
+    {
+      "src": "/logo-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/logo-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    }
+  ]
+}

apps/web/public/push-sw.js

@@ -0,0 +1,52 @@
+/*
+ * TaskStream's service worker: push notifications only. It caches nothing,
+ * so a new deploy never leaves an old version of the app behind.
+ *
+ * The API sends `{ title, body, url, tag }` (see Notifier's payloadOf).
+ */
+self.addEventListener('install', () => self.skipWaiting());
+self.addEventListener('activate', (event) =>
+  event.waitUntil(self.clients.claim()),
+);
+
+self.addEventListener('push', (event) => {
+  let data = {};
+  try {
+    data = event.data ? event.data.json() : {};
+  } catch {
+    data = { body: event.data ? event.data.text() : '' };
+  }
+  event.waitUntil(
+    self.registration.showNotification(data.title || 'TaskStream', {
+      body: data.body || '',
+      tag: data.tag,
+      icon: '/logo-192.png',
+      badge: '/logo-96.png',
+      data: { url: data.url || '/' },
+    }),
+  );
+});
+
+// A tap opens the ticket: in a TaskStream tab already open, or in a new one.
+self.addEventListener('notificationclick', (event) => {
+  event.notification.close();
+  const target = new URL(
+    event.notification.data?.url || '/',
+    self.location.origin,
+  ).href;
+  event.waitUntil(
+    self.clients
+      .matchAll({ type: 'window', includeUncontrolled: true })
+      .then((tabs) => {
+        for (const tab of tabs) {
+          if (
+            new URL(tab.url).origin === self.location.origin &&
+            'focus' in tab
+          ) {
+            return tab.focus().then(() => tab.navigate(target));
+          }
+        }
+        return self.clients.openWindow(target);
+      }),
+  );
+});

apps/web/src/index.html

@@ -12,6 +12,8 @@
     <link rel="icon" type="image/x-icon" href="favicon.ico" />
     <link rel="icon" type="image/png" sizes="96x96" href="logo-96.png" />
     <link rel="apple-touch-icon" href="logo.png" />
+    <!-- Installable (on iPhone, push only reaches an installed web app) -->
+    <link rel="manifest" href="manifest.webmanifest" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <!-- Inter, like pireon.dev · Geist Mono only for data (ticket keys, counters, versions) -->