feat: push notifications on each device (Web Push)

- What reaches the bell also reaches the devices where the person
  turned «Avisos en este dispositivo» on, with TaskStream closed: the
  Notifier sends each new notification encrypted (aes128gcm) and signed
  with VAPID, and forgets subscriptions the push service dropped
  (404/410). A failure never blocks the event stream.
- The API keeps one subscription per device (push_subscriptions) and
  exposes the VAPID public key in the notification settings; GraphQL
  subscribePush/unsubscribePush, REST /me/push-subscriptions. Without
  VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off.
- The web registers /push-sw.js, a service worker that only shows the
  notification and opens its ticket on a tap (no caching, served
  without cache by nginx), and a manifest that makes it installable,
  which iPhones need for push.
- The bell's toggles show their text next to them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/dto/requests.dto.ts

@@ -1212,6 +1212,31 @@ export class NotificationSettingsDto {
   email!: boolean;
 }
 
+export class PushSubscriptionDto {
+  @ApiProperty({
+    description: 'The push service URL (PushSubscription.endpoint)',
+  })
+  @IsUrl({ protocols: ['https'], require_tld: false })
+  endpoint!: string;
+
+  @ApiProperty({ description: 'keys.p256dh of the subscription' })
+  @IsString()
+  @MaxLength(200)
+  p256dh!: string;
+
+  @ApiProperty({ description: 'keys.auth of the subscription' })
+  @IsString()
+  @MaxLength(100)
+  auth!: string;
+}
+
+export class PushEndpointDto {
+  @ApiProperty({ description: 'The endpoint of the device to turn off' })
+  @IsString()
+  @MaxLength(2000)
+  endpoint!: string;
+}
+
 // ---- Git --------------------------------------------------------------------
 
 export class AddGitRepositoryDto {

libs/api/tracker/presenters/src/lib/http/dto/responses.dto.ts

@@ -844,4 +844,11 @@ export class NotificationSettingsResponseDto {
   @ApiProperty({ description: 'Copies by e-mail' }) email!: boolean;
   @ApiProperty({ description: 'Whether this installation can send e-mail' })
   emailAvailable!: boolean;
+  @ApiProperty({
+    type: String,
+    nullable: true,
+    description:
+      'VAPID public key to subscribe a device to push with; null: no push here',
+  })
+  pushPublicKey!: string | null;
 }

libs/api/tracker/presenters/src/lib/http/notifications.controller.ts

@@ -1,5 +1,19 @@
-import { Body, Controller, Get, Post, Put, Query } from '@nestjs/common';
-import { ApiOkResponse, ApiOperation, ApiTags } from '@nestjs/swagger';
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  HttpCode,
+  Post,
+  Put,
+  Query,
+} from '@nestjs/common';
+import {
+  ApiNoContentResponse,
+  ApiOkResponse,
+  ApiOperation,
+  ApiTags,
+} from '@nestjs/swagger';
 import { User } from '@task-stream/api/identity/domain';
 import {
   ApiPireonAuth,
@@ -14,6 +28,8 @@ import {
   MarkNotificationsReadDto,
   MyNotificationsQueryDto,
   NotificationSettingsDto,
+  PushEndpointDto,
+  PushSubscriptionDto,
 } from './dto/requests.dto';
 import {
   MyNotificationsDto,
@@ -67,4 +83,32 @@ export class NotificationsController {
   ) {
     return this.notifications.updateSettings(me.id, body);
   }
+
+  @Post('push-subscriptions')
+  @HttpCode(204)
+  @ApiOperation({
+    summary: "Push on this device (a browser's Web Push subscription)",
+  })
+  @ApiNoContentResponse()
+  @ApiCommandErrors()
+  async subscribePush(
+    @CurrentUser() me: User,
+    @Body() body: PushSubscriptionDto,
+  ): Promise<void> {
+    await this.notifications.subscribePush(me.id, body.endpoint, {
+      p256dh: body.p256dh,
+      auth: body.auth,
+    });
+  }
+
+  @Delete('push-subscriptions')
+  @HttpCode(204)
+  @ApiOperation({ summary: 'Push off on this device' })
+  @ApiNoContentResponse()
+  async unsubscribePush(
+    @CurrentUser() me: User,
+    @Body() body: PushEndpointDto,
+  ): Promise<void> {
+    await this.notifications.unsubscribePush(me.id, body.endpoint);
+  }
 }