feat: push notifications on each device (Web Push)

- What reaches the bell also reaches the devices where the person
  turned «Avisos en este dispositivo» on, with TaskStream closed: the
  Notifier sends each new notification encrypted (aes128gcm) and signed
  with VAPID, and forgets subscriptions the push service dropped
  (404/410). A failure never blocks the event stream.
- The API keeps one subscription per device (push_subscriptions) and
  exposes the VAPID public key in the notification settings; GraphQL
  subscribePush/unsubscribePush, REST /me/push-subscriptions. Without
  VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off.
- The web registers /push-sw.js, a service worker that only shows the
  notification and opens its ticket on a tap (no caching, served
  without cache by nginx), and a manifest that makes it installable,
  which iPhones need for push.
- The bell's toggles show their text next to them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/web/tracker/application/src/index.ts

@@ -1,6 +1,7 @@
 export * from './lib/notifications';
 export * from './lib/facades/projects.facade';
 export * from './lib/facades/calendar.facade';
+export * from './lib/facades/push.facade';
 export * from './lib/facades/project.facade';
 export * from './lib/facades/board.facade';
 export * from './lib/facades/issue.facade';

libs/web/tracker/application/src/lib/facades/push.facade.ts

@@ -0,0 +1,60 @@
+import { inject, Injectable, signal } from '@angular/core';
+import {
+  NotificationsGateway,
+  PushDevice,
+} from '@task-stream/web/tracker/domain';
+import { firstValueFrom } from 'rxjs';
+
+/**
+ * Push on this device: the browser subscribes and the API keeps it, so the
+ * notifications of the bell also reach the device with TaskStream closed.
+ */
+@Injectable({ providedIn: 'root' })
+export class PushFacade {
+  private readonly device = inject(PushDevice);
+  private readonly gateway = inject(NotificationsGateway);
+
+  readonly supported = this.device.supported;
+  readonly on = signal(false);
+  readonly busy = signal(false);
+  readonly error = signal<string | null>(null);
+
+  /** Whether this browser has push on now. */
+  async refresh(): Promise<void> {
+    this.on.set(!!(await this.device.current().catch(() => null)));
+  }
+
+  async turnOn(publicKey: string): Promise<void> {
+    await this.run(async () => {
+      const subscription = await this.device.subscribe(publicKey);
+      await firstValueFrom(this.gateway.subscribePush(subscription));
+      this.on.set(true);
+    });
+  }
+
+  async turnOff(): Promise<void> {
+    await this.run(async () => {
+      const endpoint = await this.device.unsubscribe();
+      if (endpoint)
+        await firstValueFrom(this.gateway.unsubscribePush(endpoint));
+      this.on.set(false);
+    });
+  }
+
+  private async run(step: () => Promise<void>): Promise<void> {
+    this.busy.set(true);
+    this.error.set(null);
+    try {
+      await step();
+    } catch (error) {
+      this.error.set(
+        error instanceof Error && error.message
+          ? error.message
+          : 'No se han podido activar los avisos',
+      );
+      await this.refresh();
+    } finally {
+      this.busy.set(false);
+    }
+  }
+}