Add Web Push, mobile login and manual escalate for the mobile companion

Sandbar sends Web Push (VAPID + aes128gcm, standard library only) to devices
registered for a topic, serves the companion PWA at /app/, allows one CORS
origin, and exposes a read-only Hammerhead edge view and POST .../escalate.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -45,3 +45,17 @@ SANDBAR_MASTER_KEY=
 #SANDBAR_SMTP_USER=
 #SANDBAR_SMTP_PASSWORD=
 #SANDBAR_SMTP_FROM=sandbar@example.com
+
+# Mobile companion app (the sandbar-mobile PWA): Web Push, served from Sandbar or from another site.
+# Folder holding the app's files; Sandbar serves them at /app/. Needs HTTPS (or localhost) for push.
+#SANDBAR_APP_DIR=../sandbar-mobile/public
+# If the app is hosted on another origin instead, allow it to call the API.
+#SANDBAR_APP_ORIGIN=https://sandbar-app.example.com
+# Contact that push services (Google, Apple, Mozilla) can reach if Sandbar misbehaves. Defaults to SANDBAR_URL when that is https.
+#SANDBAR_VAPID_SUBJECT=mailto:you@example.com
+# Development only: allow push endpoints on plain http and private addresses.
+#SANDBAR_PUSH_DEV=1
+# Show Hammerhead's edges and tunnel state in the app. Use an account without two-factor sign-in, read-only if you can.
+#SANDBAR_HAMMERHEAD_URL=https://hammerhead.example.com
+#SANDBAR_HAMMERHEAD_EMAIL=
+#SANDBAR_HAMMERHEAD_PASSWORD=