feat(gui): notifications settings for push devices and apps

A Notifications tab in Settings for push: turn it on for this browser, see and remove devices, turn Puter's own pushes on or off, and see which apps can send pushes. Part of PUT-2172. Stacks on #4353. Replaces #4347.

What

Push client contract (src/gui/src/helpers/pushClient.js, doc/push-client.md): the browser's push client comes from an extension through api.use()['push.registerPushClient']?.(client), with enable(), disable() and status(). Without one, Settings says push isn't available.

Notifications tab (shown only when pushEnabled is set)

• This browser: on, off, blocked, unavailable. Turning it on sends a test push and asks whether it arrived.
• Puter notifications: a switch for pushes about shares, deploys and other Puter updates.
• Your devices: label (or a name from the user agent), last seen, "This browser", remove with a confirm.
• Apps that can send you notifications: turn each off (POST /auth/revoke-user-app).
• Every server value is escaped; app icons load only from https or this origin.

Without a push service. The /push/* routes come from an extension. When they're missing, the tab says push isn't available on this server instead of showing load errors, and device removal only treats device_not_found as already removed.

Docs

• doc/push-client.md: the pushEnabled and registerServiceWorkerScript contract, which routes the extension serves and what a missing route returns, and the payload format.
• rate-limits-and-quotas.md keeps only the app.message limits from #4316.

Removing this browser. Remove on the device marked "This browser" goes through the push client's disable(), like Turn off, so the browser's token and local record go too. It then sends the plain DELETE as well, which covers a browser whose local record was cleared. Other devices still get only the DELETE. Tests: this browser (client plus DELETE, card turns off), a lost local record (the DELETE still removes it), another device (DELETE only), and a push service that's unavailable (error shown, device kept).

Tests

GUI full suite: 1312 passed (three new tab tests for a missing push service)
backend full suite: 13904 passed, 9 failed (worker runtime tests that need a built worker preamble; same on main locally)

Review follow-ups

• Turn on and Turn off run once however often the button is pressed while they're in flight: the card renders the button disabled while busy, and a status read begun earlier can't redraw it.

Verified on staging (2026-10-26)

In Google Chrome on macOS against a deployment with a push service: Turn on showed the browser prompt, registered the device (listed as "This browser"), sent the test push, and asked "Did you see a notification?". The banner arrived.

After Turn on: this browser is on and listed under Your devices, and the test push asks whether it arrived.

Not yet checked: turning push off, removing a device, and the Puter preference switch stopping pushes.