feat: push notifications on each device (Web Push)

- What reaches the bell also reaches the devices where the person
  turned «Avisos en este dispositivo» on, with TaskStream closed: the
  Notifier sends each new notification encrypted (aes128gcm) and signed
  with VAPID, and forgets subscriptions the push service dropped
  (404/410). A failure never blocks the event stream.
- The API keeps one subscription per device (push_subscriptions) and
  exposes the VAPID public key in the notification settings; GraphQL
  subscribePush/unsubscribePush, REST /me/push-subscriptions. Without
  VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off.
- The web registers /push-sw.js, a service worker that only shows the
  notification and opens its ticket on a tap (no caching, served
  without cache by nginx), and a manifest that makes it installable,
  which iPhones need for push.
- The bell's toggles show their text next to them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/graphql/inputs.ts

@@ -689,3 +689,14 @@ export class ProjectSettingsInput {
   @Type(() => AreaOptionInput)
   areas!: AreaOptionInput[];
 }
+
+@InputType({
+  description: "A browser's Web Push subscription (PushSubscription.toJSON())",
+})
+export class PushSubscriptionInput {
+  @Field()
+  @IsUrl({ protocols: ['https'], require_tld: false })
+  endpoint!: string;
+  @Field() @IsString() @MaxLength(200) p256dh!: string;
+  @Field() @IsString() @MaxLength(100) auth!: string;
+}

libs/api/tracker/presenters/src/lib/graphql/notification.resolver.ts

@@ -7,6 +7,7 @@ import {
   NotificationGql,
   NotificationSettingsGql,
 } from './types';
+import { PushSubscriptionInput } from './inputs';
 
 /** The signed-in person's notifications. */
 @Resolver(() => NotificationGql)
@@ -40,6 +41,27 @@ export class NotificationResolver {
     return true;
   }
 
+  @Mutation(() => Boolean, { description: 'Push on this device' })
+  async subscribePush(
+    @CurrentUser() me: User,
+    @Args('subscription') subscription: PushSubscriptionInput,
+  ) {
+    await this.notifications.subscribePush(me.id, subscription.endpoint, {
+      p256dh: subscription.p256dh,
+      auth: subscription.auth,
+    });
+    return true;
+  }
+
+  @Mutation(() => Boolean, { description: 'Push off on this device' })
+  async unsubscribePush(
+    @CurrentUser() me: User,
+    @Args('endpoint') endpoint: string,
+  ) {
+    await this.notifications.unsubscribePush(me.id, endpoint);
+    return true;
+  }
+
   @Mutation(() => NotificationSettingsGql)
   updateNotificationSettings(
     @CurrentUser() me: User,

libs/api/tracker/presenters/src/lib/graphql/types.ts

@@ -642,6 +642,12 @@ export class NotificationSettingsGql {
     description: 'Whether this installation can send e-mail at all',
   })
   emailAvailable!: boolean;
+  @Field(() => String, {
+    nullable: true,
+    description:
+      'VAPID public key to subscribe a device to push with; null: no push here',
+  })
+  pushPublicKey!: string | null;
 }
 
 @ObjectType('CommandResult', {