推送通知：Web Push（网页 / PWA）+ 桌面原生通知

页面 / PWA 关闭、或桌面窗口非前台时，收到文件、消息、传输完成 / 失败以系统通知提醒。
判定统一为「页面打开走应用内提示，否则系统通知」，三端各自落地；网页端的判定直接复用
Hub.SendTo 的投递结果，零额外状态。

- Web Push（VAPID，账号无关）：服务端 internal/push.Sender 在事件未经 SSE 投递到目标
  设备时（即该设备页面已关）发推送，文案按订阅 locale 在服务端渲染（中简 / 中繁 / 英）、
  404 / 410 自动清理死订阅；新增 push_subscriptions 表（含 locale，主键为 endpoint 的
  SHA-256 以幂等 upsert）+ /api/push/{vapid-key, subscribe POST/DELETE} 端点
- 事件挂接：transfer:incoming / message（离线返 202，文本随推送送达）/ transfer:state
  DONE|FAILED，均未投递才推
- 配置 CDROP_VAPID_PUBLIC_KEY / CDROP_VAPID_PRIVATE_KEY（半对即拒启动，都空则推送惰性
  关闭）+ just vapid-keygen 生成工具（cmd/vapidgen）
- 前端：service worker 加 push / notificationclick（仍不拦截 /api 与导航）；net/push.ts
  订阅管理 + push store slice + 设置页「推送通知」面板（仅浏览器 / PWA）；登录后 resyncPush
  把既有订阅重新登记到当前用户，换用户 / endpoint 轮换 / 切换语言皆自愈
- 桌面原生通知：platform/notify_{darwin,windows,other}.go + notify_darwin.m，仅窗口非
  前台时弹原生通知（macOS UNUserNotificationCenter，未签名时安全空操作、待签名后显示；
  Windows go-toast 即用）；app.go ShowNotification 绑定，前端 notifyNativeIfBackground
  复用 hub 事件分发 + 客户端本地化
- 文档：README / .env.example / compose 模板补 CDROP_VAPID_* 配置

注：sqlc v1.31.1 对 query 文件里的多字节字符会错位偏移、生成损坏 SQL，故 query 注释保持纯
ASCII（文件内留有警示）。

web/src/routes/settings.tsx

@@ -1,4 +1,4 @@
-import { useMemo, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
 import {
     Anchor,
     Container,
@@ -8,11 +8,18 @@ import {
     Title,
 } from "@mantine/core";
 import { createFileRoute, Link, redirect, useNavigate } from "@tanstack/react-router";
-import { LogOut, Trash2 } from "lucide-react";
+import { Bell, LogOut, Trash2 } from "lucide-react";
 import { logout, syncWebDeviceName } from "../features/auth/auth";
 import { DesktopSettings } from "../features/desktop/DesktopSettings";
 import { isDesktop, persistDesktopDeviceName } from "../net/desktop";
 import { apiFetch } from "../net/api";
+import {
+    currentPushState,
+    disablePush,
+    enablePush,
+    pushSupported,
+    type PushState,
+} from "../net/push";
 import { useAppStore, type DeviceInfo } from "../store";
 import { t } from "../i18n";
 import { formatRelative, isAsciiDeviceName } from "../utils/format";
@@ -236,6 +243,8 @@ function SettingsPage()
 
                 {isDesktop() && <DesktopSettings />}
 
+                {pushSupported() && <PushPanel />}
+
                 <Panel title={t("settings.peers.title")}>
                     {peerDevices.length === 0 ? (
                         <Text size="sm" c="dimmed">{t("settings.peers.empty")}</Text>
@@ -279,6 +288,89 @@ function SettingsPage()
     );
 }
 
+// PushPanel：浏览器 / PWA 的 Web Push 开关。仅 pushSupported() 为真时渲染（桌面壳
+// 与 dev 均为 false——桌面走原生通知、dev 无 SW）。订阅权威态在浏览器 pushManager，
+// 挂载时用 currentPushState 读取一次。
+function PushPanel()
+{
+    const [ state, setState ] = useState<PushState | null>(null);
+    const [ busy, setBusy ] = useState(false);
+
+    useEffect(() =>
+    {
+        let alive = true;
+        void currentPushState().then((s) => { if (alive) { setState(s); } });
+        return () => { alive = false; };
+    }, []);
+
+    const handleEnable = async () =>
+    {
+        setBusy(true);
+        try
+        {
+            const s = await enablePush();
+            setState(s);
+            if (s.subscribed) { toast.ok(t("settings.push.enableOk")); }
+            else if (s.permission === "denied") { toast.warn(t("settings.push.denied")); }
+            else { toast.error(t("settings.push.failed")); }
+        }
+        finally { setBusy(false); }
+    };
+
+    const handleDisable = async () =>
+    {
+        setBusy(true);
+        try
+        {
+            const s = await disablePush();
+            setState(s);
+            toast.ok(t("settings.push.disableOk"));
+        }
+        finally { setBusy(false); }
+    };
+
+    const subscribed = state?.subscribed ?? false;
+    const denied = state?.permission === "denied";
+
+    return (
+        <Panel title={t("settings.push.title")}>
+            <Stack gap="sm">
+                <Text size="sm" c="dimmed">{t("settings.push.hint")}</Text>
+                {denied && !subscribed && (
+                    <Text size="sm" style={{ color: "var(--state-error)" }}>
+                        {t("settings.push.deniedHint")}
+                    </Text>
+                )}
+                <Group>
+                    {subscribed ? (
+                        <Button
+                            variant="ghost"
+                            leftIcon={<Bell size={14} />}
+                            loading={busy}
+                            onClick={handleDisable}
+                        >
+                            {t("settings.push.disable")}
+                        </Button>
+                    ) : (
+                        <Button
+                            variant="primary"
+                            leftIcon={<Bell size={14} />}
+                            loading={busy}
+                            disabled={denied}
+                            onClick={handleEnable}
+                        >
+                            {t("settings.push.enable")}
+                        </Button>
+                    )}
+                    {subscribed && (
+                        <Badge tone="online">{t("settings.push.enabled")}</Badge>
+                    )}
+                </Group>
+            </Stack>
+        </Panel>
+    );
+}
+
 function PeerRow(props: { device: DeviceInfo; removing: boolean; onRemove: () => void })
 {
     const { device, removing, onRemove } = props;