Add incoming webhooks, fix stale service worker and push re-registration

- Webhooks for automations: per-job secret, Gitea/GitHub HMAC signatures,
  payload appended to the instructions; settings on the automations page
- Service worker gets a new file name per build (proxies that cache *.js
  served a stale worker, which broke updates and Android installation);
  /sw.js is a kill switch that removes old workers
- Push: devices re-register their subscription with the server on start and
  before a test; the test reports why a push service rejected a message

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/vite.config.ts

@@ -4,11 +4,18 @@ import { VitePWA } from "vite-plugin-pwa";
 
 const backend = process.env.CODECRAFT_BACKEND ?? "http://127.0.0.1:8787";
 
+const BUILD_ID = Date.now().toString(36);
+
 export default defineConfig({
   plugins: [
     react(),
     VitePWA({
       registerType: "autoUpdate",
+      // A new file name per build: reverse proxies with "cache assets" (e.g. Nginx
+      // Proxy Manager) cache *.js by URL – a stale service worker would break
+      // updates and installation. /sw.js is a kill switch for old installations.
+      filename: `sw-${BUILD_ID}.js`,
+      injectRegister: false,
       includeAssets: ["icon.svg", "apple-touch-icon.png"],
       manifest: {
         name: "CodeCraft",
@@ -38,9 +45,9 @@ export default defineConfig({
         navigateFallbackDenylist: [/^\/api/, /^\/cli/],
         runtimeCaching: [],
         // The STEP importer (OpenCascade, ~8 MB) is loaded only when needed.
-        globIgnores: ["**/occt-import-js*"],
+        globIgnores: ["**/occt-import-js*", "**/screenshots/**", "sw.js"],
         // Web Push handlers (push, notificationclick).
-        importScripts: ["push-sw.js"],
+        importScripts: ["push-sw.mjs"],
       },
     }),
   ],