feat: push notifications on each device (Web Push)

- What reaches the bell also reaches the devices where the person
  turned «Avisos en este dispositivo» on, with TaskStream closed: the
  Notifier sends each new notification encrypted (aes128gcm) and signed
  with VAPID, and forgets subscriptions the push service dropped
  (404/410). A failure never blocks the event stream.
- The API keeps one subscription per device (push_subscriptions) and
  exposes the VAPID public key in the notification settings; GraphQL
  subscribePush/unsubscribePush, REST /me/push-subscriptions. Without
  VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off.
- The web registers /push-sw.js, a service worker that only shows the
  notification and opens its ticket on a tap (no caching, served
  without cache by nginx), and a manifest that makes it installable,
  which iPhones need for push.
- The bell's toggles show their text next to them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/notifications/notifier.ts

@@ -9,6 +9,8 @@ import {
 import { ChangeFeed } from '../ports/change-feed';
 import { NotificationMailer } from '../ports/notification-mailer';
 import { NotificationsRepository } from '../ports/notifications.repository';
+import { PushPayload, PushSender } from '../ports/push-sender';
+import { PushSubscriptionsRepository } from '../ports/push-subscriptions.repository';
 import { UserDirectory } from '../ports/user-directory';
 import { versionOf } from '../event-handlers/read-model-notifier';
 
@@ -39,6 +41,8 @@ export class Notifier {
     private readonly changeFeed: ChangeFeed,
     private readonly mailer: NotificationMailer,
     private readonly users: UserDirectory,
+    private readonly push: PushSender,
+    private readonly pushSubscriptions: PushSubscriptionsRepository,
   ) {}
 
   async deliver(
@@ -89,6 +93,33 @@ export class Notifier {
     if (this.mailer.enabled && delivered.length) {
       await this.email(delivered);
     }
+    if (this.push.publicKey && delivered.length) {
+      await this.pushToDevices(delivered);
+    }
+  }
+
+  /**
+   * To every device where the person turned push on. Like e-mail, a failure
+   * never blocks the event stream; a device the push service forgot is
+   * forgotten here too.
+   */
+  private async pushToDevices(
+    notifications: NotificationReadModel[],
+  ): Promise<void> {
+    for (const notification of notifications) {
+      const devices = await this.pushSubscriptions.forUser(notification.userId);
+      for (const device of devices) {
+        try {
+          const result = await this.push.send(device, payloadOf(notification));
+          if (result === 'gone')
+            await this.pushSubscriptions.forget(device.endpoint);
+        } catch (error) {
+          this.logger.warn(
+            `Push to ${notification.userId} failed: ${(error as Error).message}`,
+          );
+        }
+      }
+    }
   }
 
   /** A failed e-mail never blocks the event stream: it is logged and skipped. */
@@ -116,3 +147,18 @@ export class Notifier {
     }
   }
 }
+
+/** What the device shows: the ticket (or project), the line and its page. */
+export function payloadOf(notification: NotificationReadModel): PushPayload {
+  const project = encodeURIComponent(notification.projectKey);
+  return {
+    title: notification.issueKey
+      ? `TaskStream · ${notification.issueKey}`
+      : `TaskStream · ${notification.projectKey}`,
+    body: notification.summary,
+    url: notification.issueKey
+      ? `/p/${project}/issues/${encodeURIComponent(notification.issueKey)}`
+      : `/p/${project}`,
+    tag: notification.id,
+  };
+}