Add Web Push, mobile login and manual escalate for the mobile companion

Sandbar sends Web Push (VAPID + aes128gcm, standard library only) to devices
registered for a topic, serves the companion PWA at /app/, allows one CORS
origin, and exposes a read-only Hammerhead edge view and POST .../escalate.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/sandbar/store.go

@@ -65,6 +65,10 @@ CREATE TABLE IF NOT EXISTS alerts (
 	resolved_at INTEGER NOT NULL DEFAULT 0, incident_id TEXT NOT NULL DEFAULT '');
 CREATE INDEX IF NOT EXISTS alerts_key ON alerts(key, status);
 CREATE INDEX IF NOT EXISTS alerts_due ON alerts(status, next_at);
+-- Web Push registrations, one per installed companion app.
+CREATE TABLE IF NOT EXISTS push_subs (
+	id TEXT PRIMARY KEY, user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE, endpoint TEXT NOT NULL UNIQUE,
+	p256dh TEXT NOT NULL, auth TEXT NOT NULL, topics TEXT NOT NULL, device TEXT NOT NULL, created INTEGER NOT NULL);
 CREATE TABLE IF NOT EXISTS events (
 	id INTEGER PRIMARY KEY AUTOINCREMENT, scope TEXT NOT NULL, ref TEXT NOT NULL, time INTEGER NOT NULL,
 	kind TEXT NOT NULL, actor TEXT NOT NULL, text TEXT NOT NULL);