Add the Web Push sender for the push channel (Feature 19)

push.Sender implements notify.Sender for the "push" channel with
webpush-go and the VAPID key pair: it sends {title, body, url, tag} to
every stored subscription with a TTL of 12 hours, one request each.
Per subscription, an accepted notification records last_success_at, any
failure increments failure_count, and a 404 or 410 deletes the
subscription. Send succeeds when one device accepted it or when there
are no subscriptions (logged as nothing to send); otherwise it returns
an error so the outbox retries. Errors and logs name subscriptions by
id; a transport *url.Error is unwrapped so the endpoint is never quoted.

A mailto: VAPID subject is passed to webpush-go as its bare address,
since webpush-go prefixes mailto: itself.

The server registers the sender with the notify service.

Maestro task 32a1a4ad-9221-46de-8468-3ffce19b108c.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

go.mod

@@ -3,6 +3,7 @@ module code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest
 go 1.25.0
 
 require (
+	github.com/SherClockHolmes/webpush-go v1.4.0
 	github.com/coreos/go-oidc/v3 v3.21.0
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/oklog/ulid/v2 v2.1.2
@@ -14,10 +15,12 @@ require (
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	golang.org/x/crypto v0.31.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	modernc.org/libc v1.75.7 // indirect
 	modernc.org/mathutil v1.7.1 // indirect