feat: web push notifications for new chapters

- Service worker (src/service-worker.ts) handles push events and
  notification clicks, navigating to the book page on tap
- Web app manifest (manifest.webmanifest) linked in app.html
- Profile page: push notification toggle (subscribe/unsubscribe)
  using the browser Notification + PushManager API with VAPID
- API route POST/DELETE /api/push-subscription proxies to backend
- Go backend: push_subscriptions PocketBase collection storage
  methods (SavePushSubscription, DeletePushSubscription,
  ListPushSubscriptionsByBook) in storage/store.go
- handlers_push.go: GET vapid-public-key, POST/DELETE subscription
- webpush package: VAPID-signed sends via webpush-go, SendToBook
  fans out to all users who have the book in their library
- Runner fires push to subscribers whenever ChaptersScraped > 0
  after a successful book scrape
- Config: VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY, VAPID_SUBJECT env vars
- domain.ScrapeResult gets a Slug field; orchestrator populates it

ui/src/routes/api/push-subscription/+server.ts

@@ -0,0 +1,63 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { backendFetch } from '$lib/server/scraper';
+
+/**
+ * POST /api/push-subscription
+ * Registers a browser push subscription for the current user.
+ * Body: { endpoint, keys: { p256dh, auth } }
+ */
+export const POST: RequestHandler = async ({ request, locals }) => {
+	if (!locals.user) throw error(401, 'Login required');
+
+	const body = await request.json().catch(() => null);
+	if (!body?.endpoint || !body?.keys?.p256dh || !body?.keys?.auth) {
+		throw error(400, 'Invalid push subscription object');
+	}
+
+	const res = await backendFetch('/api/push-subscriptions', {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({
+			user_id: locals.user.id,
+			endpoint: body.endpoint,
+			p256dh: body.keys.p256dh,
+			auth: body.keys.auth,
+		}),
+	});
+
+	if (!res.ok) {
+		const msg = await res.text().catch(() => 'backend error');
+		throw error(res.status, msg);
+	}
+
+	return json({ success: true });
+};
+
+/**
+ * DELETE /api/push-subscription
+ * Unregisters a push subscription by endpoint.
+ * Body: { endpoint }
+ */
+export const DELETE: RequestHandler = async ({ request, locals }) => {
+	if (!locals.user) throw error(401, 'Login required');
+
+	const body = await request.json().catch(() => null);
+	if (!body?.endpoint) throw error(400, 'endpoint required');
+
+	const res = await backendFetch('/api/push-subscriptions', {
+		method: 'DELETE',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({
+			user_id: locals.user.id,
+			endpoint: body.endpoint,
+		}),
+	});
+
+	if (!res.ok) {
+		const msg = await res.text().catch(() => 'backend error');
+		throw error(res.status, msg);
+	}
+
+	return json({ success: true });
+};