推送通知：Web Push（网页 / PWA）+ 桌面原生通知

页面 / PWA 关闭、或桌面窗口非前台时，收到文件、消息、传输完成 / 失败以系统通知提醒。
判定统一为「页面打开走应用内提示，否则系统通知」，三端各自落地；网页端的判定直接复用
Hub.SendTo 的投递结果，零额外状态。

- Web Push（VAPID，账号无关）：服务端 internal/push.Sender 在事件未经 SSE 投递到目标
  设备时（即该设备页面已关）发推送，文案按订阅 locale 在服务端渲染（中简 / 中繁 / 英）、
  404 / 410 自动清理死订阅；新增 push_subscriptions 表（含 locale，主键为 endpoint 的
  SHA-256 以幂等 upsert）+ /api/push/{vapid-key, subscribe POST/DELETE} 端点
- 事件挂接：transfer:incoming / message（离线返 202，文本随推送送达）/ transfer:state
  DONE|FAILED，均未投递才推
- 配置 CDROP_VAPID_PUBLIC_KEY / CDROP_VAPID_PRIVATE_KEY（半对即拒启动，都空则推送惰性
  关闭）+ just vapid-keygen 生成工具（cmd/vapidgen）
- 前端：service worker 加 push / notificationclick（仍不拦截 /api 与导航）；net/push.ts
  订阅管理 + push store slice + 设置页「推送通知」面板（仅浏览器 / PWA）；登录后 resyncPush
  把既有订阅重新登记到当前用户，换用户 / endpoint 轮换 / 切换语言皆自愈
- 桌面原生通知：platform/notify_{darwin,windows,other}.go + notify_darwin.m，仅窗口非
  前台时弹原生通知（macOS UNUserNotificationCenter，未签名时安全空操作、待签名后显示；
  Windows go-toast 即用）；app.go ShowNotification 绑定，前端 notifyNativeIfBackground
  复用 hub 事件分发 + 客户端本地化
- 文档：README / .env.example / compose 模板补 CDROP_VAPID_* 配置

注：sqlc v1.31.1 对 query 文件里的多字节字符会错位偏移、生成损坏 SQL，故 query 注释保持纯
ASCII（文件内留有警示）。

desktop/app.go

@@ -195,6 +195,18 @@ func (a *App) ApplyRemoteClipboard(content, sourceDevice string) {
 	}, a.DeviceName())
 }
 
+// ShowNotification is bound to the WebView. The JS hub calls it when a
+// notify-worthy event (incoming file / message / transfer done|failed) arrives
+// while the window is NOT in the foreground — so the user gets a native system
+// notification instead of an in-app cue they'd miss. Foreground events stay
+// in-app: the JS gates on document focus/visibility, so this is only ever
+// invoked for the background case. Title/body arrive already localized by the
+// WebView (client-side i18n). macOS display additionally needs a signed bundle
+// (D6) — until then platform.Notify no-ops safely there; Windows shows now.
+func (a *App) ShowNotification(title, body string) {
+	platform.Notify(title, body)
+}
+
 // StartLogin is bound to the WebView. It runs the loopback PKCE flow in the
 // background and reports the outcome via Wails events ("oauth:success" /
 // "oauth:error"). On success it persists the full session (with refresh_token)

desktop/go.mod

@@ -4,6 +4,7 @@ go 1.24
 
 require (
 	fyne.io/systray v1.12.2
+	git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3
 	github.com/ebitengine/purego v0.10.1
 	github.com/wailsapp/wails/v2 v2.12.0
 	github.com/zalando/go-keyring v0.2.8
@@ -12,7 +13,6 @@ require (
 )
 
 require (
-	git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3 // indirect
 	github.com/bep/debounce v1.2.1 // indirect
 	github.com/danieljoos/wincred v1.2.3 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect

desktop/platform/notify_darwin.go

@@ -0,0 +1,31 @@
+//go:build darwin
+
+package platform
+
+/*
+#cgo darwin CFLAGS: -x objective-c -fobjc-arc
+#cgo darwin LDFLAGS: -framework Foundation -framework UserNotifications
+#include <stdlib.h>
+
+void cdropNotify(const char *title, const char *body);
+*/
+import "C"
+
+import "unsafe"
+
+// Notify shows a native system notification.
+//
+// macOS uses UNUserNotificationCenter, which REQUIRES the app bundle to be
+// code-signed with a valid bundle identifier (see desktop/PLAN.md D3/D6). On an
+// unsigned / ad-hoc build the ObjC side detects the missing bundle proxy and
+// no-ops rather than crashing — so this is safe to call from the current build;
+// it simply won't display until the signing + notarization pipeline (D6) ships.
+//
+// Safe to call from any goroutine: the native work hops to the main queue.
+func Notify(title, body string) {
+	ct := C.CString(title)
+	cb := C.CString(body)
+	defer C.free(unsafe.Pointer(ct))
+	defer C.free(unsafe.Pointer(cb))
+	C.cdropNotify(ct, cb)
+}

desktop/platform/notify_darwin.m

@@ -0,0 +1,54 @@
+//go:build darwin
+
+#import <Foundation/Foundation.h>
+#import <UserNotifications/UserNotifications.h>
+
+// cdropNotify posts a user notification via UNUserNotificationCenter.
+//
+// Guarded for the unsigned case: UNUserNotificationCenter raises
+// NSInternalInconsistencyException ("bundleProxyForCurrentProcess is nil") when
+// the process has no signed bundle proxy. We bail when there's no bundle
+// identifier and wrap the calls in @try/@catch, so an unsigned / ad-hoc build
+// degrades to a silent no-op instead of crashing the app. On a signed build it
+// requests authorization once (idempotent after the first grant) and delivers.
+void cdropNotify(const char *title, const char *body) {
+    if (title == NULL || body == NULL) {
+        return;
+    }
+    NSString *nsTitle = [NSString stringWithUTF8String:title];
+    NSString *nsBody = [NSString stringWithUTF8String:body];
+
+    // No bundle identifier → unsigned / non-bundle build → UNUserNotificationCenter
+    // would throw. Skip; display lights up once the bundle is signed (D6).
+    if ([[NSBundle mainBundle] bundleIdentifier] == nil) {
+        return;
+    }
+
+    dispatch_async(dispatch_get_main_queue(), ^{
+        // UNUserNotificationCenter is macOS 10.14+. Guard so older targets (Wails
+        // defaults the deployment target to 10.13) compile clean and no-op there.
+        if (@available(macOS 10.14, *)) {
+            @try {
+                UNUserNotificationCenter *center = [UNUserNotificationCenter currentNotificationCenter];
+                [center requestAuthorizationWithOptions:(UNAuthorizationOptionAlert | UNAuthorizationOptionSound)
+                                      completionHandler:^(BOOL granted, NSError *_Nullable error) {
+                    if (!granted) {
+                        return;
+                    }
+                    UNMutableNotificationContent *content = [[UNMutableNotificationContent alloc] init];
+                    content.title = nsTitle;
+                    content.body = nsBody;
+                    content.sound = [UNNotificationSound defaultSound];
+
+                    UNNotificationRequest *request =
+                        [UNNotificationRequest requestWithIdentifier:[[NSUUID UUID] UUIDString]
+                                                             content:content
+                                                             trigger:nil];
+                    [center addNotificationRequest:request withCompletionHandler:nil];
+                }];
+            } @catch (NSException *exception) {
+                // Unsigned bundle or notifications unavailable — ignore.
+            }
+        }
+    });
+}

desktop/platform/notify_other.go

@@ -0,0 +1,8 @@
+//go:build !darwin && !windows
+
+package platform
+
+// Notify is a no-op on platforms without a native notification backend wired up.
+// The desktop client targets macOS and Windows; this keeps the package building
+// on other GOOS (e.g. a Linux `go vet` / CI pass).
+func Notify(_, _ string) {}

desktop/platform/notify_windows.go

@@ -0,0 +1,42 @@
+//go:build windows
+
+package platform
+
+import (
+	"os"
+	"sync"
+
+	toast "git.sr.ht/~jackmordaunt/go-toast/v2"
+)
+
+const (
+	// toastAppID 是 Windows Action Center 里显示的应用标识，与 macOS bundle id 对齐。
+	toastAppID = "net.commilitia.cdrop"
+	// toastGUID 固定不变——它把通知归属到注册表里的本应用条目；更换会让既有通知
+	// 失去归属。
+	toastGUID = "{c4d8e2a1-6b3f-4e7a-9c2d-1f5b8a0e3d6c}"
+)
+
+var toastInit sync.Once
+
+// Notify shows a native Windows toast. go-toast renders via the WinRT/COM path
+// (PowerShell fallback when the AppID isn't registered), so it works without code
+// signing — SmartScreen only gates the installer, not notifications. Best-effort:
+// errors are swallowed. SetAppData registers the app identity once so the toast
+// shows "cdrop" rather than the PowerShell host.
+func Notify(title, body string) {
+	toastInit.Do(func() {
+		data := toast.AppData{AppID: toastAppID, GUID: toastGUID}
+		if exe, err := os.Executable(); err == nil {
+			data.ActivationExe = exe
+		}
+		_ = toast.SetAppData(data)
+	})
+
+	n := toast.Notification{
+		AppID: toastAppID,
+		Title: title,
+		Body:  body,
+	}
+	_ = n.Push()
+}