Add incoming webhooks, fix stale service worker and push re-registration

- Webhooks for automations: per-job secret, Gitea/GitHub HMAC signatures,
  payload appended to the instructions; settings on the automations page
- Service worker gets a new file name per build (proxies that cache *.js
  served a stale worker, which broke updates and Android installation);
  /sw.js is a kill switch that removes old workers
- Push: devices re-register their subscription with the server on start and
  before a test; the test reports why a push service rejected a message

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/public/push-sw.mjs

@@ -0,0 +1,36 @@
+// Web Push handling, imported into the generated service worker (workbox importScripts).
+self.addEventListener("push", (event) => {
+  let data = {};
+  try {
+    data = event.data ? event.data.json() : {};
+  } catch {
+    data = { body: event.data ? event.data.text() : "" };
+  }
+  const title = data.title || "CodeCraft";
+  const prefix = { permission: "🔐 ", question: "❓ ", done: "✅ " }[data.kind] || "";
+  event.waitUntil(
+    self.registration.showNotification(prefix + title, {
+      body: data.kind === "done" ? data.body || "Finished" : data.body || "",
+      tag: data.tag || "codecraft",
+      renotify: true,
+      icon: "/icon-192.png",
+      badge: "/icon-192.png",
+      data: { url: data.url || "/" },
+    }),
+  );
+});
+
+self.addEventListener("notificationclick", (event) => {
+  event.notification.close();
+  const url = new URL((event.notification.data && event.notification.data.url) || "/", self.location.origin).href;
+  event.waitUntil(
+    self.clients.matchAll({ type: "window", includeUncontrolled: true }).then((list) => {
+      for (const client of list) {
+        if (new URL(client.url).origin === self.location.origin) {
+          return client.focus().then((c) => (c && "navigate" in c ? c.navigate(url) : c));
+        }
+      }
+      return self.clients.openWindow(url);
+    }),
+  );
+});