Phase 4: Web Push notifications (pywebpush + VAPID)

Backend: PushSubscription model/migration, VAPID config + `cli.py
generate-vapid-keys`, push_service.send_push_to_user (upsert-by-endpoint
subscribe/unsubscribe, auto-cleanup of expired 404/410 subscriptions),
/api/push/* router, and ConnectionManager now tracks connected user IDs
per room so chat.py can push only to offline members after broadcasting
to online ones.

Two test-infra bugs found and fixed along the way: send_push_to_user
takes the caller's AsyncSession and is awaited inline rather than fired
via asyncio.create_task with its own session (background tasks were
outliving the test event loop); and the ws_client fixture now uses
NullPool to eliminate a connection-pool checkout race that was failing
WS tests intermittently.

Frontend: service worker rebuilt with vite-plugin-pwa's injectManifest
strategy (custom src/sw.ts) so it can add push/notificationclick
handlers alongside the existing precaching and StaleWhileRevalidate
routes ported over from generateSW. New subscribe/unsubscribe flow
(lib/push.ts, api/push.ts) with a toggle in the account menu.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/vite.config.ts

@@ -2,16 +2,25 @@ import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
 import { VitePWA } from 'vite-plugin-pwa'
 
-const READ_CACHE_EXPIRATION = {
-  maxEntries: 50,
-  maxAgeSeconds: 7 * 24 * 60 * 60, // 7 days
-}
-
 // https://vite.dev/config/
 export default defineConfig({
   plugins: [
     react(),
     VitePWA({
+      // generateSW (Phase 3) can't add custom event listeners, and push /
+      // notificationclick need exactly that -- injectManifest means we hand-
+      // write the service worker (src/sw.ts); its runtime-caching routes are
+      // registered there directly instead of via the `workbox` option below
+      // (which only applies to generateSW).
+      strategies: 'injectManifest',
+      srcDir: 'src',
+      filename: 'sw.ts',
+      injectManifest: {
+        // Workbox's default globPatterns exclude the manifest's own output
+        // dir, which is fine, but be explicit about what the app shell
+        // precache should contain.
+        globPatterns: ['**/*.{js,css,html,ico,png,svg,webmanifest}'],
+      },
       registerType: 'autoUpdate',
       manifest: {
         name: 'KeepItTalking',
@@ -31,77 +40,6 @@ export default defineConfig({
           },
         ],
       },
-      workbox: {
-        navigateFallbackDenylist: [/^\/api/, /^\/ws/],
-        // urlPattern uses function matchers against url.pathname rather than
-        // RegExp (which Workbox tests against the *full href*, origin
-        // included -- a `^/api/` anchor would silently never match).
-        runtimeCaching: [
-          // Never serve a stale cached "who am I" response.
-          {
-            urlPattern: ({ url }) => url.pathname.startsWith('/api/auth/'),
-            handler: 'NetworkOnly',
-          },
-          // Cache-and-refresh: show the last known list/history immediately,
-          // update from the network in the background. Routes default to
-          // matching GET only, so mutations to these same paths are
-          // untouched and still go straight to network.
-          {
-            urlPattern: ({ url }) => url.pathname === '/api/rooms/mine',
-            handler: 'StaleWhileRevalidate',
-            options: {
-              cacheName: 'api-rooms-mine',
-              expiration: READ_CACHE_EXPIRATION,
-              cacheableResponse: { statuses: [0, 200] },
-            },
-          },
-          {
-            urlPattern: ({ url }) => url.pathname === '/api/rooms',
-            handler: 'StaleWhileRevalidate',
-            options: {
-              cacheName: 'api-rooms-open',
-              expiration: READ_CACHE_EXPIRATION,
-              cacheableResponse: { statuses: [0, 200] },
-            },
-          },
-          {
-            urlPattern: ({ url }) =>
-              /^\/api\/rooms\/[^/]+\/messages$/.test(url.pathname),
-            handler: 'StaleWhileRevalidate',
-            options: {
-              cacheName: 'api-room-messages',
-              expiration: READ_CACHE_EXPIRATION,
-              cacheableResponse: { statuses: [0, 200] },
-            },
-          },
-          {
-            urlPattern: ({ url }) =>
-              /^\/api\/rooms\/[^/]+\/members$/.test(url.pathname),
-            handler: 'StaleWhileRevalidate',
-            options: {
-              cacheName: 'api-room-members',
-              expiration: READ_CACHE_EXPIRATION,
-              cacheableResponse: { statuses: [0, 200] },
-            },
-          },
-          {
-            urlPattern: ({ url }) => url.pathname === '/api/invites/mine',
-            handler: 'StaleWhileRevalidate',
-            options: {
-              cacheName: 'api-invites-mine',
-              expiration: READ_CACHE_EXPIRATION,
-              cacheableResponse: { statuses: [0, 200] },
-            },
-          },
-          // Defensive default: anything else under /api/ (including any
-          // future GET endpoint) stays network-only until explicitly opted
-          // in above.
-          {
-            urlPattern: ({ url }) => url.pathname.startsWith('/api/'),
-            handler: 'NetworkOnly',
-          },
-        ],
-      },
     }),
   ],
   server: {