feat(client): FCM web push registration

web/index.html loads the Firebase compat SDK and defines
window.kcGetPushToken() — inits Firebase from window.KC_FIREBASE, asks for
notification permission, registers the service worker and returns an FCM
token (or null if not configured / denied). web/firebase-messaging-sw.js
shows background notifications.

browser_web.dart exposes getPushToken() over that JS function (stub returns
null off-web). After every successful login AppState fires
_registerForPush() -> POST /api/push/register, best-effort.

Config placeholders carry the known values (projectId konfi-castle-app,
messagingSenderId 307226979593); apiKey / appId / vapidKey still say
REPLACE_ME, so push stays inert until they're filled in — the app runs
either way. flutter analyze/test/build web green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

client/app/lib/browser_stub.dart

@@ -12,3 +12,6 @@ Future<({String name, List<int> bytes})?> pickFile() async =>
     throw UnsupportedError(_msg);
 void downloadText(String filename, String content, {String mime = 'text/plain'}) =>
     throw UnsupportedError(_msg);
+
+/// No push on non-web platforms in this build.
+Future<String?> getPushToken() async => null;