Add Web Push notifications (PWA)

Wires up the previously-scaffolded VAPID/DeviceToken infrastructure end
to end: browser subscription flow on the Profile page's existing "Push
Notifications" toggle, a service worker push/notificationclick handler,
and server-side sending from the daily task digest. Also broadens that
digest's eligibility query so push-only users (email notifications off)
aren't silently skipped, and adds `generate_vapid_keys` since the pinned
py-vapid's own key generator is broken against current cryptography.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

users/management/commands/generate_vapid_keys.py

@@ -0,0 +1,36 @@
+"""
+Generate a VAPID keypair for Web Push notifications.
+
+Uses `cryptography` directly rather than py_vapid's own Vapid02.generate_keys(),
+which raises `TypeError: curve must be an EllipticCurve instance` against
+newer versions of `cryptography` (confirmed with cryptography 46.0.3 / py-vapid 1.9.2).
+"""
+
+import base64
+
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives import serialization
+from django.core.management.base import BaseCommand
+
+
+class Command(BaseCommand):
+    help = 'Generate a VAPID public/private keypair for Web Push notifications'
+
+    def handle(self, *args, **options):
+        private_key = ec.generate_private_key(ec.SECP256R1())
+        public_key = private_key.public_key()
+
+        private_value = private_key.private_numbers().private_value
+        private_bytes = private_value.to_bytes(32, 'big')
+        private_b64 = base64.urlsafe_b64encode(private_bytes).rstrip(b'=').decode()
+
+        public_bytes = public_key.public_bytes(
+            encoding=serialization.Encoding.X962,
+            format=serialization.PublicFormat.UncompressedPoint,
+        )
+        public_b64 = base64.urlsafe_b64encode(public_bytes).rstrip(b'=').decode()
+
+        self.stdout.write('Add these to your environment configuration:\n')
+        self.stdout.write(f'VAPID_PUBLIC_KEY={public_b64}')
+        self.stdout.write(f'VAPID_PRIVATE_KEY={private_b64}')
+        self.stdout.write('VAPID_ADMIN_EMAIL=<your admin contact email>')

users/views.py

@@ -424,7 +424,9 @@ class ProfileView(View):
     def get(self, request):
         if not request.user.is_authenticated:
             return redirect('login')
-        return render(request, 'users/profile.html')
+        return render(request, 'users/profile.html', {
+            'vapid_public_key': settings.VAPID_PUBLIC_KEY,
+        })
 
     def post(self, request):
         if not request.user.is_authenticated:
@@ -440,7 +442,8 @@ class ProfileView(View):
         user.save()
 
         return render(request, 'users/profile.html', {
-            'success': 'Profile updated successfully.'
+            'success': 'Profile updated successfully.',
+            'vapid_public_key': settings.VAPID_PUBLIC_KEY,
         })