Staff push notifications, and revalidate embedded assets

Notifications: staff turn them on per device from a new Notifications page,
pick each type (bans, gags, mutes and silences added or lifted, server down
and back up) and quiet hours. A watcher polls SimpleAdmin's tables, so in-game
penalties are sent too. Web Push with VAPID and RFC 8291 encryption in
internal/push, standard library only. Tables in sql/push.sql, created at
startup; the VAPID key is made on first start and kept in saw_settings.
Penalty notifications link to the public list searching for the player
(#bans?q=<steamid64>). The Android app delegates notifications (versionCode 3).

Caching: pages, scripts and styles are served with Cache-Control: no-cache
and an ETag, so a deploy shows up at once instead of after Cloudflare's
default 4-hour browser cache.

internal/web/auth.go

@@ -166,10 +166,10 @@ func (s *Server) adminPage(static fs.FS) http.HandlerFunc {
 			slog.Error("admin page", "err", err)
 		}
 		if id == nil {
-			http.ServeFileFS(w, r, static, "signin.html")
+			serveAsset(w, r, static, "signin.html")
 			return
 		}
-		http.ServeFileFS(w, r, static, "admin.html")
+		serveAsset(w, r, static, "admin.html")
 	}
 }