feat(08-03): push notification backend — DB model, migration, API router, VAPID setup

- Add PushSubscription ORM model with unique(user_id, endpoint) constraint
- Add Alembic migration 012 for push_subscriptions table
- Add push router (subscribe, unsubscribe, send) in shared/api/push.py
- Mount push router in gateway/main.py
- Add pywebpush to gateway dependencies for server-side VAPID delivery
- Wire push trigger into WebSocket handler (fires when client disconnects mid-stream)
- Add VAPID keys to .env / .env.example
- Add push/install i18n keys in en/es/pt message files

.env.example

@@ -61,3 +61,11 @@ DEBUG=false
 
 # Tenant rate limits (requests per minute defaults)
 DEFAULT_RATE_LIMIT_RPM=60
+
+# -----------------------------------------------------------------------------
+# Web Push Notifications (VAPID keys)
+# Generate with: cd packages/portal && npx web-push generate-vapid-keys
+# -----------------------------------------------------------------------------
+NEXT_PUBLIC_VAPID_PUBLIC_KEY=your-vapid-public-key
+VAPID_PRIVATE_KEY=your-vapid-private-key
+VAPID_CLAIMS_EMAIL=admin@yourdomain.com