Add Web Push, mobile login and manual escalate for the mobile companion

Sandbar sends Web Push (VAPID + aes128gcm, standard library only) to devices
registered for a topic, serves the companion PWA at /app/, allows one CORS
origin, and exposes a read-only Hammerhead edge view and POST .../escalate.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/mobile-api.md

@@ -0,0 +1,20 @@
+# Mobile companion API
+
+Used by the sandbar-mobile PWA. All calls take `Authorization: Bearer <api key>`.
+
+| Call | What it does |
+| --- | --- |
+| `POST /api/v1/mobile/login` `{email, password, device}` | Returns `{token, keyId, user}`. The token is a new API key named `Mobile: <device>`; delete it under API keys to sign that phone out. No cookie is set. |
+| `GET /api/v1/push/key` | The VAPID public key (base64url) for `pushManager.subscribe`. Created on first use, stored sealed in the database. |
+| `POST /api/v1/push/subscriptions` `{endpoint, keys:{p256dh, auth}, topics, device}` | Registers or updates a device (matched by endpoint). The caller's personal topic is always added. |
+| `GET /api/v1/push/subscriptions` | The caller's devices. |
+| `DELETE /api/v1/push/subscriptions/{id}` | Removes one. |
+| `POST /api/v1/push/test` | Sends a test push to the caller's devices and reports each result. |
+| `POST /api/v1/alerts/{id}/escalate` | Runs the alert's next escalation step now. |
+| `GET /api/v1/hammerhead/edges` | Read-only edges and online state from a linked Hammerhead (`{configured, edges}`). |
+
+Push payload (JSON, encrypted with aes128gcm): `id, topic, title, message, priority, tags, time, status`, plus `alert`
+(the alert id) on on-call alerts, so the app can offer Acknowledge, Snooze and Escalate. Messages are cut to 1200 characters.
+A push service answering 404 or 410 removes the subscription.
+
+`SANDBAR_APP_DIR` serves the app at `/app/`. `SANDBAR_APP_ORIGIN` lets an app hosted elsewhere call `/api/v1/*` (CORS).