feat(app): add opt-in PWA push notifications - #47374

Summary

Add opt-in Web Push for response-ready and session-error notifications when the web app/PWA is closed. The OpenCode server sends encrypted notifications directly to browser push services; no Electron wrapper or separate notification relay is needed.

• Add per-server push settings with explicit permission consent, subscription recovery, localized titles, category preferences, and actionable unsupported/denied/error states.
• Keep push workers separate from the existing offline-cache worker. Notifications open the correct server/session and replace the ordinary local alert for a successfully registered server.
• Persist VAPID keys and subscriptions, inherit server authentication, validate browser origins, restrict outbound destinations to supported HTTPS push services, and prohibit redirects. Server credentials never enter the push worker.
• Revoke saved subscriptions when the server password or authentication mode changes, preserving the VAPID key but requiring registration with current credentials.
• Listen for top-level session success/failure independently of browser event-stream connections; ignore subagent completions and avoid exposing response text or error details.
• Regenerate the Promise/Effect clients and published OpenAPI documents. Document setup, privacy, and delivery limits in packages/server/WEB_PUSH.md.

Verification

• App unit/browser suites, focused subscription/worker tests, and built-app notification-settings tests.
• Chromium service-worker suite, including a test that closes every app-origin page, stops the worker, delivers a browser-level push event, and verifies a native notification after the worker wakes.
• Server encryption/signature, persistence, authentication/origin, destination-validation, filtering, expiration, timeout, and shutdown tests; client/protocol regression tests.
• App/E2E, server, protocol, client, and website typechecks; app and website production builds; generated-document checks.
• Inspected desktop/mobile settings, denied/install states, empty session data, and a very long server name.

The Chromium test injects an already-decoded push at the browser boundary. Server tests separately verify real encryption and VAPID signatures. These checks do not claim live APNs/FCM delivery or physical iOS validation.

Operational limits

The server must remain awake and online; only the PWA can close. iOS/iPadOS requires a Home Screen installation on 16.4 or later. Opted-in pushes remain visible while the app is open to respect browser userVisibleOnly requirements. Electron and existing non-push alerts remain unchanged.

Delivery is best-effort: up to 100 subscriptions, a bounded 128-event in-memory queue, four concurrent sends per event, 10-second deadlines, and a one-hour provider TTL. Failed sends are not retried, and unsent notifications do not survive a server restart. No merge or deployment is included.

Requested by: @Hona (Hona via Slack)