Add incoming webhooks, fix stale service worker and push re-registration

- Webhooks for automations: per-job secret, Gitea/GitHub HMAC signatures,
  payload appended to the instructions; settings on the automations page
- Service worker gets a new file name per build (proxies that cache *.js
  served a stale worker, which broke updates and Android installation);
  /sw.js is a kill switch that removes old workers
- Push: devices re-register their subscription with the server on start and
  before a test; the test reports why a push service rejected a message

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/push.ts

@@ -47,7 +47,17 @@ export async function disablePush(): Promise<void> {
   localStorage.removeItem("codecraft.push");
 }
 
-export async function testPush(): Promise<number> {
-  const r = await post<{ sent: number }>("/push/test", {});
-  return r.sent;
+/** Re-register this device's existing subscription with the server (idempotent). */
+export async function syncPush(): Promise<boolean> {
+  const sub = await currentSubscription().catch(() => null);
+  if (!sub) return false;
+  await post("/push/subscribe", sub.toJSON());
+  localStorage.setItem("codecraft.push", "1");
+  return true;
+}
+
+export async function testPush(): Promise<{ sent: number; errors: string[] }> {
+  // Make sure the server knows this device before testing.
+  await syncPush();
+  return post<{ sent: number; errors: string[] }>("/push/test", {});
 }