Add incoming webhooks, fix stale service worker and push re-registration

- Webhooks for automations: per-job secret, Gitea/GitHub HMAC signatures,
  payload appended to the instructions; settings on the automations page
- Service worker gets a new file name per build (proxies that cache *.js
  served a stale worker, which broke updates and Android installation);
  /sw.js is a kill switch that removes old workers
- Push: devices re-register their subscription with the server on start and
  before a test; the test reports why a push service rejected a message

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/public/sw.js

@@ -0,0 +1,15 @@
+// Retired service worker location (the app now uses /sw-<build>.js). Devices that
+// still run the old worker get this one as an update: it removes itself and
+// reloads open windows, which then register the current worker.
+self.addEventListener("install", () => self.skipWaiting());
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    (async () => {
+      const keys = await caches.keys();
+      await Promise.all(keys.map((k) => caches.delete(k)));
+      await self.registration.unregister();
+      const windows = await self.clients.matchAll({ type: "window" });
+      windows.forEach((w) => w.navigate(w.url));
+    })(),
+  );
+});