feat(client): FCM web push registration

web/index.html loads the Firebase compat SDK and defines
window.kcGetPushToken() — inits Firebase from window.KC_FIREBASE, asks for
notification permission, registers the service worker and returns an FCM
token (or null if not configured / denied). web/firebase-messaging-sw.js
shows background notifications.

browser_web.dart exposes getPushToken() over that JS function (stub returns
null off-web). After every successful login AppState fires
_registerForPush() -> POST /api/push/register, best-effort.

Config placeholders carry the known values (projectId konfi-castle-app,
messagingSenderId 307226979593); apiKey / appId / vapidKey still say
REPLACE_ME, so push stays inert until they're filled in — the app runs
either way. flutter analyze/test/build web green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

client/app/lib/api.dart

@@ -4,6 +4,7 @@ import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
 import 'package:shared_preferences/shared_preferences.dart';
 
+import 'browser.dart' as browser;
 import 'oidc.dart';
 
 /// Backend base URL. Override at build/run time with
@@ -662,6 +663,10 @@ class Api {
         'gemeindeId': gemeindeId,
       }) as Map<String, dynamic>;
 
+  // --- push ---
+  Future<void> registerDevice(String token, {String platform = 'web'}) =>
+      _post('/push/register', {'token': token, 'platform': platform});
+
   // --- chat: REST for channels/history; live send/receive is the /chat WS ---
   Future<List<ChatChannel>> channels(String kcId) async {
     final list = await _get('/chat/$kcId/channels') as List<dynamic>;
@@ -746,6 +751,16 @@ class AppState extends ChangeNotifier {
     }
     _authError = null;
     notifyListeners();
+    _registerForPush(); // best-effort, fire and forget
+  }
+
+  Future<void> _registerForPush() async {
+    try {
+      final pushToken = await browser.getPushToken();
+      if (pushToken != null) await _api.registerDevice(pushToken);
+    } catch (_) {
+      // push is optional
+    }
   }
 
   Future<void> _clear(SharedPreferences prefs) async {

client/app/lib/browser_stub.dart

@@ -12,3 +12,6 @@ Future<({String name, List<int> bytes})?> pickFile() async =>
     throw UnsupportedError(_msg);
 void downloadText(String filename, String content, {String mime = 'text/plain'}) =>
     throw UnsupportedError(_msg);
+
+/// No push on non-web platforms in this build.
+Future<String?> getPushToken() async => null;

client/app/lib/browser_web.dart

@@ -3,6 +3,20 @@ import 'dart:js_interop';
 
 import 'package:web/web.dart' as web;
 
+/// Provided by the inline Firebase bootstrap in web/index.html. Returns an FCM
+/// registration token, or null if push isn't configured / permission denied.
+@JS('kcGetPushToken')
+external JSPromise<JSString?> _kcGetPushToken();
+
+Future<String?> getPushToken() async {
+  try {
+    final result = await _kcGetPushToken().toDart;
+    return result?.toDart;
+  } catch (_) {
+    return null;
+  }
+}
+
 /// Per-tab storage for the PKCE verifier + CSRF state (cleared when the tab
 /// closes), and the little bit of `window` access the OIDC redirect needs.