Add incoming webhooks, fix stale service worker and push re-registration

- Webhooks for automations: per-job secret, Gitea/GitHub HMAC signatures,
  payload appended to the instructions; settings on the automations page
- Service worker gets a new file name per build (proxies that cache *.js
  served a stale worker, which broke updates and Android installation);
  /sw.js is a kill switch that removes old workers
- Push: devices re-register their subscription with the server on start and
  before a test; the test reports why a push service rejected a message

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/prefsSync.ts

@@ -32,6 +32,8 @@ export async function startPrefsSync() {
   } catch {
     /* offline or old server */
   }
+  // Push subscription of this device: make sure the server has it.
+  void import("./push").then((m) => m.syncPush()).catch(() => undefined);
   onThemeChange(push);
   onLangChange(push);
 }