[NOTIF-002] Add browser push notifications

[chev0004]

Outline

Summary

Makes the Push Notifications setting real: turning it on asks for browser permission only at that moment, registers a service worker, and stores the push subscription per user; denied permission and unsupported browsers show clear inline states and the toggle stays off.

---

Changes & Enhancements

• Type of Change:
  • Feature
  • Bugfix
  • Refactor
  • Chore
• Changes:
  • (Database):
    • Add push_subscriptions table keyed by endpoint with per-user cascade.
  • (Server):
    • Add POST /api/push/subscription validating and upserting the browser subscription, and DELETE removing all of the user's subscriptions.
  • (Client):
    • Add public/sw.js handling push display and notification clicks.
    • Add src/lib/push/client.ts: support detection, permission request, service worker registration, subscribe with the VAPID public key, and unsubscribe.
    • The settings toggle only flips on after permission is granted and the subscription is stored; turning it off unsubscribes and deletes stored subscriptions.
  • (Config):
    • Document NEXT_PUBLIC_VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY in .env.example; push reports as unavailable when unset.
  • (i18n):
    • Add denied, unsupported, and error copy to en and ja.

---

Page / App Changes

Affected Next.js Routes (Local):

• /[lang]/settings (push toggle requests permission, shows denied/unsupported states)

Before (Screenshot)

After (Screenshot)

---

Component / Storybook Changes

Affected Storybook Components (Local):

Before (Screenshot)

After (Screenshot)

---

Not Doing

• Sending pushes: delivery requires wiring notification events to the web push protocol with the VAPID private key, which belongs with the notification taxonomy work. This PR covers permission, subscription storage, and lifecycle.

---

Other (Remarks)

This PR adds a migration numbered 0012 in parallel with other open PRs; whichever merges later needs drizzle/meta/_journal.json reconciled.

---

Checklists

• Code is well-documented (comments, JSDoc, etc.).
• Existing comments were updated as needed.
• No out-of-scope changes are included.
• Write TODO comments where future work is required.
• Removed unnecessary debug code (e.g., console.log, debugger).
• Self-reviewed and tested locally.