Add Web Push notifications (PWA)

Wires up the previously-scaffolded VAPID/DeviceToken infrastructure end
to end: browser subscription flow on the Profile page's existing "Push
Notifications" toggle, a service worker push/notificationclick handler,
and server-side sending from the daily task digest. Also broadens that
digest's eligibility query so push-only users (email notifications off)
aren't silently skipped, and adds `generate_vapid_keys` since the pinned
py-vapid's own key generator is broken against current cryptography.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

templates/base.html

@@ -147,7 +147,7 @@
     {% endif %}
     {% endblock %}
 
-    <script src="{% static 'js/app.js' %}?v=4"></script>
+    <script src="{% static 'js/app.js' %}?v=6"></script>
     {% block extra_js %}{% endblock %}
 </body>
 </html>