chore(client): set FCM web-push VAPID key (public)

Client push-token acquisition is now fully configured; a real browser
session (logged-in user granting notification permission) is needed to
mint the first token. Backend delivery still needs the service-account JSON.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

client/app/web/index.html

@@ -32,10 +32,9 @@
   <title>KC-App</title>
   <link rel="manifest" href="manifest.json">
 
-  <!-- Firebase Cloud Messaging (web push). vapidKey still needs the Web Push
+  <!-- Firebase Cloud Messaging (web push). `vapidKey` is the *public* half of
-       certificate key pair (Project settings > Cloud Messaging > Web config).
+       the Web Push certificate key pair; the private half stays in Firebase.
-       Until it's set kcGetPushToken() returns null and the app runs without
+       Backend sending still needs a service-account JSON + PUSH_PROVIDER=fcm. -->
-       push. -->
   <script src="https://www.gstatic.com/firebasejs/10.13.2/firebase-app-compat.js"></script>
   <script src="https://www.gstatic.com/firebasejs/10.13.2/firebase-messaging-compat.js"></script>
   <script>
@@ -47,7 +46,7 @@
       messagingSenderId: "307226979593",
       appId: "1:307226979593:web:66898b2c78b2d110ef77d8",
       measurementId: "G-NK8K5VV40D",
-      vapidKey: "REPLACE_ME"
+      vapidKey: "BEAHrnIzkTBGSEws1J_HRvsTtc6nqvmW4MvFMTfljmjuunqo4yiJoUcq8_jKIt_hbm4diOt0czG28l-dpvGK8T8"
     };
     window.kcGetPushToken = async function () {
       try {