feat(client): FCM web push registration

web/index.html loads the Firebase compat SDK and defines
window.kcGetPushToken() — inits Firebase from window.KC_FIREBASE, asks for
notification permission, registers the service worker and returns an FCM
token (or null if not configured / denied). web/firebase-messaging-sw.js
shows background notifications.

browser_web.dart exposes getPushToken() over that JS function (stub returns
null off-web). After every successful login AppState fires
_registerForPush() -> POST /api/push/register, best-effort.

Config placeholders carry the known values (projectId konfi-castle-app,
messagingSenderId 307226979593); apiKey / appId / vapidKey still say
REPLACE_ME, so push stays inert until they're filled in — the app runs
either way. flutter analyze/test/build web green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

client/app/web/firebase-messaging-sw.js

@@ -0,0 +1,21 @@
+// Background handler for FCM web push. Keep the config in sync with
+// window.KC_FIREBASE in index.html (a service worker can't read window).
+// Fill in apiKey / appId from the Firebase console before enabling push.
+importScripts('https://www.gstatic.com/firebasejs/10.13.2/firebase-app-compat.js');
+importScripts('https://www.gstatic.com/firebasejs/10.13.2/firebase-messaging-compat.js');
+
+firebase.initializeApp({
+  apiKey: 'REPLACE_ME',
+  projectId: 'konfi-castle-app',
+  messagingSenderId: '307226979593',
+  appId: 'REPLACE_ME',
+});
+
+firebase.messaging().onBackgroundMessage(function (payload) {
+  const n = payload.notification || {};
+  self.registration.showNotification(n.title || 'KC-App', {
+    body: n.body || '',
+    icon: '/icons/Icon-192.png',
+    data: payload.data || {},
+  });
+});