feat: push notifications on each device (Web Push)

- What reaches the bell also reaches the devices where the person
  turned «Avisos en este dispositivo» on, with TaskStream closed: the
  Notifier sends each new notification encrypted (aes128gcm) and signed
  with VAPID, and forgets subscriptions the push service dropped
  (404/410). A failure never blocks the event stream.
- The API keeps one subscription per device (push_subscriptions) and
  exposes the VAPID public key in the notification settings; GraphQL
  subscribePush/unsubscribePush, REST /me/push-subscriptions. Without
  VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off.
- The web registers /push-sw.js, a service worker that only shows the
  notification and opens its ticket on a tap (no caching, served
  without cache by nginx), and a manifest that makes it installable,
  which iPhones need for push.
- The bell's toggles show their text next to them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/web/tracker/domain/src/lib/ports/gateways.ts

@@ -6,6 +6,7 @@ import {
   AutomationInput,
   BoardColumn,
   CalendarFeed,
+  PushDeviceSubscription,
   CommandResult,
   Comment,
   Epic,
@@ -350,6 +351,26 @@ export abstract class NotificationsGateway {
   abstract markRead(ids?: string[]): Observable<void>;
   abstract settings(): Observable<NotificationSettings>;
   abstract updateSettings(email: boolean): Observable<NotificationSettings>;
+  /** Push on this device. */
+  abstract subscribePush(
+    subscription: PushDeviceSubscription,
+  ): Observable<void>;
+  /** Push off on this device. */
+  abstract unsubscribePush(endpoint: string): Observable<void>;
+}
+
+/**
+ * This browser's side of push: its service worker and push subscription.
+ * Not every browser has it (and on iPhone only an installed web app does).
+ */
+export abstract class PushDevice {
+  abstract get supported(): boolean;
+  /** This browser's subscription, if push is on here. */
+  abstract current(): Promise<PushDeviceSubscription | null>;
+  /** Asks for permission and subscribes; throws when refused. */
+  abstract subscribe(publicKey: string): Promise<PushDeviceSubscription>;
+  /** Unsubscribes; the endpoint it had, if any. */
+  abstract unsubscribe(): Promise<string | null>;
 }
 
 /** Realtime (GraphQL subscriptions over WebSocket). */