Web Push notifications: 'we're live now' + service-reminder channel

[Salem874]

ELI5

We'd let members tick a box to get a little browser popup the moment a livestream goes live (or 10 minutes before). It's free, works on phones and laptops, and saves us SMS credits.

Detailed proposal

Add Web Push (VAPID) as a third notification channel alongside email and SMS (#272).

Schema: new tblPushSubscriptions (id, userId nullable for anon, endpoint, p256dh, auth, userAgent, siteId, createdAt, lastSeenAt, revokedAt). One migration.

Keys: VAPID public/private keypair stored in _auth_keys/vapid.json (gitignored, server-managed). Public key exposed via /push/vapid-public-key.

Routes:

• POST /push/subscribe — store subscription, CSRF + rate-limited
• POST /push/unsubscribe — soft-delete by endpoint
• POST /admin/push/test — admin-only test ping

Service worker: extend existing sw.js (#233) with push + notificationclick handlers — click opens livestream URL or event detail page.

Triggers (reuse SMS dispatcher from #272):

• Calendar event going live (livestream URL populated + start time crossed)
• T-10min reminder for events flagged notifyMembers
• Prayer request marked urgent (opt-in)

UI: account-page toggle "Browser notifications" with permission prompt; admin push-config panel mirrors SMS config (quiet hours, per-site enable).

Sending: lightweight cURL-based Web Push sender in _core/Push.php (JWT signed with VAPID key via existing SimpleJWT vendor lib — no new dependency).

Composes with: Calendar (#137/#138), Prayer Requests, livestream embed (future #?), Sabbath quiet-hours from #272.

Pros

• Zero per-message cost vs SMS — scales to whole congregation
• Works on desktop + Android (iOS 16.4+ when added to home screen via PWA)
• Reuses existing SimpleJWT, sw.js, quiet-hours, CSRF, rate-limit primitives
• Real-time "we're live now" is the headline COP feature we currently lack
• Anonymous subscriptions possible (no account needed)

Cons

• iOS requires PWA install — discoverability friction
• Push endpoints expire silently; need cleanup job for stale subscriptions
• Browser permission prompts have low accept rates if mistimed
• Adds a fourth notification surface to keep consistent (email/SMS/in-app/push)
• VAPID key rotation is disruptive (invalidates all subscriptions)

How necessary?

Medium — lands with regular attendees and remote/overseas members who follow livestreams.

Acceptance criteria

• tblPushSubscriptions migration applied with unique index on endpoint
• VAPID keypair generated, stored in _auth_keys/, documented in DEV_NOTES
• Subscribe/unsubscribe endpoints with CSRF + rate limiting
• sw.js handles push and notificationclick events
• Account-page toggle + admin test-send button
• Calendar "going live" + T-10min triggers fire push respecting quiet hours
• Stale-endpoint cleanup runs nightly

Estimated effort

6-8 hours focused work (single PR, extends existing notification + PWA infrastructure).

---

Filed during Church Online Platform competitive analysis on 2026-06-15. Decision pending.