Staff push notifications, and revalidate embedded assets

Notifications: staff turn them on per device from a new Notifications page,
pick each type (bans, gags, mutes and silences added or lifted, server down
and back up) and quiet hours. A watcher polls SimpleAdmin's tables, so in-game
penalties are sent too. Web Push with VAPID and RFC 8291 encryption in
internal/push, standard library only. Tables in sql/push.sql, created at
startup; the VAPID key is made on first start and kept in saw_settings.
Penalty notifications link to the public list searching for the player
(#bans?q=<steamid64>). The Android app delegates notifications (versionCode 3).

Caching: pages, scripts and styles are served with Cache-Control: no-cache
and an ETag, so a deploy shows up at once instead of after Cloudflare's
default 4-hour browser cache.

internal/store/store.go

@@ -41,6 +41,9 @@ func New(db *sql.DB, loc *time.Location, serverID int64, timeMode int) *Store {
 
 func (s *Store) DB() *sql.DB { return s.db }
 
+// Location is SimpleAdmin's Timezone.
+func (s *Store) Location() *time.Location { return s.loc }
+
 // wall turns a time into the naive wall-clock form SimpleAdmin stores.
 func (s *Store) wall(t time.Time) time.Time {
 	t = t.In(s.loc)