Add push notifications and unread counters

[olegberman]

Summary

• add authenticated per-device Web Push subscription storage and delivery on newly stored inbound mail
• add exact accessible Inbox and Catch-all counters to navigation, the document title, and supported PWA badges
• add explicit notification controls, safe sign-out cleanup, foreground refresh, and visible service-worker notifications
• generate customer-owned VAPID secrets during installation and signed updates
• add D1 migration, staging configuration, release notes for 0.1.23, and comprehensive notification tests

Why

Installed HQBase PWAs need timely new-mail alerts without exposing mail metadata or weakening mailbox authorization. This implementation keeps subscriptions and VAPID secrets in customer-owned Cloudflare infrastructure, rechecks live access before delivery, and treats push as additive so mail acceptance never depends on a notification provider.

Validation

• CI=true WRANGLER_LOG_PATH=/tmp/hqbase-push-release-check.log pnpm check
• 56 unit files / 215 tests passed
• 5 Worker integration files / 13 tests passed
• coverage, architecture, production build, and setup-boundary checks passed
• CI=true WRANGLER_LOG_PATH=/tmp/hqbase-push-release-dry-run.log pnpm deploy:dry-run
• CI=true pnpm test:pwa
• rendered desktop and 390x844 browser verification