Add incoming webhooks, fix stale service worker and push re-registration

- Webhooks for automations: per-job secret, Gitea/GitHub HMAC signatures,
  payload appended to the instructions; settings on the automations page
- Service worker gets a new file name per build (proxies that cache *.js
  served a stale worker, which broke updates and Android installation);
  /sw.js is a kill switch that removes old workers
- Push: devices re-register their subscription with the server on start and
  before a test; the test reports why a push service rejected a message

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/Cargo.toml

@@ -44,3 +44,4 @@ hkdf = "0.13"
 aes-gcm = "0.11"
 pty-process = { version = "0.5.4", features = ["async"] }
 croner = "4.0.3"
+hmac = "0.13"