feat: PWA Phase 2 — push notifications

Add web push notification support: push_subscriptions table (migration
0007), VAPID-based push service, subscribe/unsubscribe API routes, SW
push+notificationclick handlers, and subscribe UI on account page.
Triggers: new version uploaded (all project members) and version
approved/rejected (uploader).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/db/src/migrations/0007_push_subscriptions.sql

@@ -0,0 +1,12 @@
+CREATE TABLE "push_subscriptions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"endpoint" text NOT NULL,
+	"p256dh" text NOT NULL,
+	"auth" text NOT NULL,
+	"user_agent" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "push_subscriptions_endpoint_unique" UNIQUE("endpoint")
+);
+--> statement-breakpoint
+ALTER TABLE "push_subscriptions" ADD CONSTRAINT "push_subscriptions_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;

packages/db/src/migrations/meta/_journal.json

@@ -50,6 +50,13 @@
       "when": 1776094119472,
       "tag": "0006_brown_lily_hollister",
       "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1745395200000,
+      "tag": "0007_push_subscriptions",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/index.ts

@@ -4,3 +4,4 @@ export * from './projects.js';
 export * from './tracks.js';
 export * from './comments.js';
 export * from './shareLinks.js';
+export * from './pushSubscriptions.js';

packages/db/src/schema/pushSubscriptions.ts

@@ -0,0 +1,14 @@
+import { pgTable, uuid, text, timestamp } from 'drizzle-orm/pg-core';
+import { users } from './users.js';
+
+export const pushSubscriptions = pgTable('push_subscriptions', {
+  id: uuid('id').defaultRandom().primaryKey(),
+  userId: uuid('user_id')
+    .notNull()
+    .references(() => users.id, { onDelete: 'cascade' }),
+  endpoint: text('endpoint').notNull().unique(),
+  p256dh: text('p256dh').notNull(),
+  auth: text('auth').notNull(),
+  userAgent: text('user_agent'),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+});