Add Web Push notifications (PWA)

Wires up the previously-scaffolded VAPID/DeviceToken infrastructure end
to end: browser subscription flow on the Profile page's existing "Push
Notifications" toggle, a service worker push/notificationclick handler,
and server-side sending from the daily task digest. Also broadens that
digest's eligibility query so push-only users (email notifications off)
aren't silently skipped, and adds `generate_vapid_keys` since the pinned
py-vapid's own key generator is broken against current cryptography.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

users/views.py

@@ -424,7 +424,9 @@ class ProfileView(View):
     def get(self, request):
         if not request.user.is_authenticated:
             return redirect('login')
-        return render(request, 'users/profile.html')
+        return render(request, 'users/profile.html', {
+            'vapid_public_key': settings.VAPID_PUBLIC_KEY,
+        })
 
     def post(self, request):
         if not request.user.is_authenticated:
@@ -440,7 +442,8 @@ class ProfileView(View):
         user.save()
 
         return render(request, 'users/profile.html', {
-            'success': 'Profile updated successfully.'
+            'success': 'Profile updated successfully.',
+            'vapid_public_key': settings.VAPID_PUBLIC_KEY,
         })