Complete UnifiedPush integration with WebPush payload encryption

[Copilot]

UnifiedPush distributors require WebPush-encrypted payloads to deliver notification content securely, which the backend previously did not support. This PR introduces WebPush encryption to the push notification pipeline to fully support UnifiedPush clients.

Changes

• Client Registration: Modified Android PushServiceImpl and PushDistributorManager to extract and transmit the WebPush pubkey and auth secrets during push endpoint registration.
• Database Schema: Expanded the PushRegistration model with webpush_auth and webpush_p256dh columns, alongside the required Alembic migration.
• Push Delivery: Integrated pywebpush into the backend notification dispatcher. When WebPush keys are present, the backend now encrypts the payload via standard WebPush protocol, falling back to a plain HTTP POST otherwise.

# Payload encryption and dispatch via pywebpush
subscription_info = {
    "endpoint": registration.push_endpoint,
    "keys": {
        "auth": registration.webpush_auth,
        "p256dh": registration.webpush_p256dh
    }
}
payload = json.dumps({"content": "activity_update", "encrypted": True})

await asyncio.to_thread(
    webpush,
    subscription_info=subscription_info,
    data=payload,
    vapid_private_key=None,
    vapid_claims=None,
    ttl=86400,
    timeout=10.0
)