feat: web push notifications (VAPID)

- push_utils.py: subscription storage + send helper (auto-prunes 410 endpoints)
- routers/push.py: GET /api/push/vapid-key (public), POST/DELETE /api/push/subscribe
- sw.js: push event listener shows notification; notificationclick focuses/opens tab
- app.js: subscribe/unsubscribe flow + "Enable notifications" toggle in settings dropdown
- tools/notify.py: web_push orchestrator tool (user-level, no admin required)
- VAPID keys in .env; pywebpush added to requirements.txt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/static/style.css

@@ -266,6 +266,7 @@
             box-sizing: border-box;
         }
         .hdr-dd-item:hover { background: var(--border); }
+        .hdr-dd-item.push-active { color: var(--accent); }
 
         .hdr-dd-divider {
             border-top: 1px solid var(--border);