feat: push notifications on each device (Web Push)

- What reaches the bell also reaches the devices where the person
  turned «Avisos en este dispositivo» on, with TaskStream closed: the
  Notifier sends each new notification encrypted (aes128gcm) and signed
  with VAPID, and forgets subscriptions the push service dropped
  (404/410). A failure never blocks the event stream.
- The API keeps one subscription per device (push_subscriptions) and
  exposes the VAPID public key in the notification settings; GraphQL
  subscribePush/unsubscribePush, REST /me/push-subscriptions. Without
  VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off.
- The web registers /push-sw.js, a service worker that only shows the
  notification and opens its ticket on a tap (no caching, served
  without cache by nginx), and a manifest that makes it installable,
  which iPhones need for push.
- The bell's toggles show their text next to them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/ports/push-sender.ts

@@ -0,0 +1,32 @@
+/** A browser's push subscription (Web Push), as the browser hands it over. */
+export interface PushSubscriptionRecord {
+  userId: string;
+  /** The push service URL of that browser on that device: unique. */
+  endpoint: string;
+  keys: { p256dh: string; auth: string };
+  createdAt: string;
+}
+
+/** What the service worker shows: a title, a line and where a tap goes. */
+export interface PushPayload {
+  title: string;
+  body: string;
+  /** A path in the web app, e.g. `/p/WEB/issues/WEB-12`. */
+  url: string;
+  /** Replaces an earlier notification with the same tag on the device. */
+  tag: string;
+}
+
+/**
+ * Sends Web Push messages (VAPID). Without keys configured it is off and
+ * nobody is offered push.
+ */
+export abstract class PushSender {
+  /** The VAPID public key browsers subscribe with; null: push is off. */
+  abstract get publicKey(): string | null;
+  /** `gone`: the browser dropped the subscription; forget it. */
+  abstract send(
+    subscription: PushSubscriptionRecord,
+    payload: PushPayload,
+  ): Promise<'sent' | 'gone'>;
+}