Add Web Push, mobile login and manual escalate for the mobile companion

Sandbar sends Web Push (VAPID + aes128gcm, standard library only) to devices
registered for a topic, serves the companion PWA at /app/, allows one CORS
origin, and exposes a read-only Hammerhead edge view and POST .../escalate.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cmd/sandbar/main.go

@@ -88,10 +88,18 @@ func main() {
 		CheckDays:    atoi("SANDBAR_CHECK_DAYS"),
 		HitDays:      atoi("SANDBAR_ANALYTICS_DAYS"),
 		TrustProxy:   os.Getenv("SANDBAR_TRUST_PROXY") == "1",
-		Version:      version,
-		AutoUpdate:   *autoUpdate,
-		UpdateServer: os.Getenv("SANDBAR_UPDATE_SERVER"),
-		UpdateRepo:   os.Getenv("SANDBAR_UPDATE_REPO"),
+		AppDir:       os.Getenv("SANDBAR_APP_DIR"),
+		AppOrigin:    os.Getenv("SANDBAR_APP_ORIGIN"),
+		VapidSubject: os.Getenv("SANDBAR_VAPID_SUBJECT"),
+
+		PushAllowPrivate:   os.Getenv("SANDBAR_PUSH_DEV") == "1",
+		HammerheadURL:      os.Getenv("SANDBAR_HAMMERHEAD_URL"),
+		HammerheadEmail:    os.Getenv("SANDBAR_HAMMERHEAD_EMAIL"),
+		HammerheadPassword: os.Getenv("SANDBAR_HAMMERHEAD_PASSWORD"),
+		Version:            version,
+		AutoUpdate:         *autoUpdate,
+		UpdateServer:       os.Getenv("SANDBAR_UPDATE_SERVER"),
+		UpdateRepo:         os.Getenv("SANDBAR_UPDATE_REPO"),
 		Restart: func(exe string) error {
 			// Let go of the port and the database, then become the new binary. If that fails, exit
 			// so the container or service manager starts it again, now from the new file.