Staff push notifications, and revalidate embedded assets

Notifications: staff turn them on per device from a new Notifications page,
pick each type (bans, gags, mutes and silences added or lifted, server down
and back up) and quiet hours. A watcher polls SimpleAdmin's tables, so in-game
penalties are sent too. Web Push with VAPID and RFC 8291 encryption in
internal/push, standard library only. Tables in sql/push.sql, created at
startup; the VAPID key is made on first start and kept in saw_settings.
Penalty notifications link to the public list searching for the player
(#bans?q=<steamid64>). The Android app delegates notifications (versionCode 3).

Caching: pages, scripts and styles are served with Cache-Control: no-cache
and an ETag, so a deploy shows up at once instead of after Cloudflare's
default 4-hour browser cache.

android/app/build.gradle

@@ -17,7 +17,7 @@ android {
         minSdk 24
         targetSdk 36
         // Bump versionCode for every APK you hand out, or Android refuses to update over the old one.
-        versionCode 2
+        versionCode 3
         versionName "1.0"
 
         resValue "string", "launch_url", siteURL + startPath

android/app/src/main/AndroidManifest.xml

@@ -3,6 +3,9 @@
      androidbrowserhelper's LauncherActivity does all of it; there is no code of our own. -->
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
 
+    <!-- Android 13+ asks before an app may show notifications; the site's request comes here. -->
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+
     <application
         android:allowBackup="false"
         android:icon="@mipmap/ic_launcher"
@@ -66,6 +69,23 @@
             android:name="com.google.androidbrowserhelper.trusted.WebViewFallbackActivity"
             android:configChanges="orientation|screenSize" />
 
+        <!-- Notification delegation: Chrome hands the site's push notifications to this service, so
+             they show as this app's, with its icon and settings, instead of Chrome's. -->
+        <service
+            android:name="com.google.androidbrowserhelper.trusted.DelegationService"
+            android:enabled="true"
+            android:exported="true">
+            <meta-data
+                android:name="android.support.customtabs.trusted.SMALL_ICON"
+                android:resource="@drawable/ic_notification" />
+            <intent-filter>
+                <action android:name="android.support.customtabs.trusted.TRUSTED_WEB_ACTIVITY_SERVICE" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
+        </service>
+        <!-- Shows Android's notification permission prompt when the site asks for it. -->
+        <activity android:name="com.google.androidbrowserhelper.trusted.NotificationPermissionRequestActivity" />
+
         <!-- Hands the splash image to Chrome while the panel loads. -->
         <provider
             android:name="androidx.core.content.FileProvider"

android/app/src/main/res/drawable/ic_notification.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- The status bar icon for notifications: the shield, white on transparent (Android tints it). -->
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="32"
+    android:viewportHeight="32">
+    <path
+        android:pathData="M16,2L28,7v9c0,7 -5,12 -12,14C9,28 4,23 4,16V7z"
+        android:strokeWidth="2.8"
+        android:strokeColor="#FFFFFFFF"
+        android:fillColor="#00000000" />
+    <path
+        android:pathData="M11,16h10M16,11v10"
+        android:strokeWidth="2.8"
+        android:strokeColor="#FFFFFFFF"
+        android:strokeLineCap="round" />
+</vector>