Add configurable browser push notifications

Goal

Add opt-in browser push notifications for high-signal issue activity, with user-controlled notification categories and conservative defaults.

Acceptance criteria

• A signed-in user can enable browser push from their settings through an explicit action; do not request browser permission automatically on page load.
• Store and manage subscriptions per browser/device, show whether the current browser is subscribed, and allow the user to disable it.
• Remove or disable expired and rejected subscriptions without failing the issue action that triggered a notification.
• Provide category-level settings for at least: mentions, new assignments, comments on relevant issues, status changes, and due-date changes.
• Default new users to direct, high-signal notifications such as mentions and newly assigned issues; broader change categories are disabled by default.
• Do not notify a user about their own action, and coalesce duplicate notifications caused by one logical change.
• Each push identifies the project and issue, summarizes the event without exposing more data than the recipient may access, and links to the relevant issue.
• Re-check current project/issue access before delivery so removed, blocked, or otherwise unauthorized users do not receive protected details.
• Push delivery is asynchronous and best-effort: provider/network failures are observable and retryable where appropriate but never roll back or delay the underlying issue mutation.
• Keep the implementation within the Go binary and Postgres unless an external component is demonstrably required; document required Web Push/VAPID configuration.
• Add store, handler, delivery, authorization, default-preference, duplicate/self-event, stale-subscription, and settings UI coverage.