Staff push notifications, and revalidate embedded assets

Notifications: staff turn them on per device from a new Notifications page,
pick each type (bans, gags, mutes and silences added or lifted, server down
and back up) and quiet hours. A watcher polls SimpleAdmin's tables, so in-game
penalties are sent too. Web Push with VAPID and RFC 8291 encryption in
internal/push, standard library only. Tables in sql/push.sql, created at
startup; the VAPID key is made on first start and kept in saw_settings.
Penalty notifications link to the public list searching for the player
(#bans?q=<steamid64>). The Android app delegates notifications (versionCode 3).

Caching: pages, scripts and styles are served with Cache-Control: no-cache
and an ETag, so a deploy shows up at once instead of after Cloudflare's
default 4-hour browser cache.

internal/web/pwa_test.go

@@ -60,3 +60,23 @@ func TestAssetLinks(t *testing.T) {
 		t.Errorf("status %d, body %s", rec.Code, got)
 	}
 }
+
+// TestAssetCaching checks embedded files must be revalidated, and answer 304 while unchanged.
+func TestAssetCaching(t *testing.T) {
+	h := (&Server{site: defaultSite()}).Handler()
+	for _, path := range []string{"/", "/static/admin.js", "/static/styles.css", "/sw.js"} {
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil))
+		tag := rec.Header().Get("ETag")
+		if rec.Code != http.StatusOK || rec.Header().Get("Cache-Control") != "no-cache" || tag == "" {
+			t.Fatalf("%s: status %d, Cache-Control %q, ETag %q", path, rec.Code, rec.Header().Get("Cache-Control"), tag)
+		}
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		req.Header.Set("If-None-Match", tag)
+		rec = httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusNotModified {
+			t.Errorf("%s with its ETag: status %d, want 304", path, rec.Code)
+		}
+	}
+}