fix: use Vapid.from_pem() instead of passing PEM string to webpush()

pywebpush 2.x routes string keys through Vapid.from_string() which only
handles raw/DER base64 — not PEM. Pre-build the Vapid object so the key
deserializes correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/push_utils.py

@@ -67,12 +67,14 @@ def _get_private_key_pem() -> str:
 def _send_one(sub: dict, payload: dict) -> bool:
     """Send a push to a single subscription. Returns False if the endpoint is stale (410)."""
     from pywebpush import webpush, WebPushException
+    from py_vapid import Vapid
 
     try:
+        vapid = Vapid.from_pem(_get_private_key_pem().encode())
         webpush(
             subscription_info=sub,
             data=json.dumps(payload),
-            vapid_private_key=_get_private_key_pem(),
+            vapid_private_key=vapid,
             vapid_claims={"sub": settings.vapid_contact},
         )
         return True