chore(client): fill in Firebase web config (apiKey / appId)

Only the VAPID key (Web Push certificate) is still REPLACE_ME; the push
guard now keys off vapidKey so nothing prompts until it's set.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

client/app/web/firebase-messaging-sw.js

@@ -1,14 +1,13 @@
 // Background handler for FCM web push. Keep the config in sync with
 // window.KC_FIREBASE in index.html (a service worker can't read window).
-// Fill in apiKey / appId from the Firebase console before enabling push.
 importScripts('https://www.gstatic.com/firebasejs/10.13.2/firebase-app-compat.js');
 importScripts('https://www.gstatic.com/firebasejs/10.13.2/firebase-messaging-compat.js');
 
 firebase.initializeApp({
-  apiKey: 'REPLACE_ME',
+  apiKey: 'AIzaSyDxBpdmW8lUHSuix--3AsWJScGQy9o3G_M',
   projectId: 'konfi-castle-app',
   messagingSenderId: '307226979593',
-  appId: 'REPLACE_ME',
+  appId: '1:307226979593:web:66898b2c78b2d110ef77d8',
 });
 
 firebase.messaging().onBackgroundMessage(function (payload) {