R9 Web Push, then the honest version: VAPID key, push subscriptions, encrypted pushes, 4.5.0 advertised

The server's VAPID key (PushKeys, made on first need, in Mongo) is the instance API's vapid.public_key and every app's
vapid_key. /api/v1/push/subscription (POST, GET, PUT, DELETE) keeps one subscription per access token, so per persona;
every notification kept (never a filtered one) is queued as a SendPush job for the subscriptions whose alert and policy
admit it, and sent through the `push` client (the safe handler, https only) encrypted as RFC 8291 aes128gcm or the
aesgcm draft with an ES256 VAPID JWT. 404/410 delete the subscription, 429/5xx/timeouts retry, other answers drop the
push. Subscriptions end with their tokens (revocation, sessions ended, suspension, deletion, a restore); backups hold
neither keys nor subscriptions. The walk of every Mastodon 4.3-4.5 client route (docs/MASTODON-API.md) added
conversations/:id/unread, domain_blocks/preview, v2 notifications clear and PUT policy, /oauth/userinfo and stubs, so both
instance APIs now say 4.5.0 (compatible; PrivaPub <release>). The pasture gets a push sink (pushsink.test) and
scenarios/push.sh in batch A.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Controllers/AppsController.cs

@@ -16,10 +16,12 @@ namespace PrivaPub.Api.Mastodon.Controllers
 	public class AppsController : MastodonController
 	{
 		readonly IOpenIddictApplicationManager _applications;
+		readonly PrivaPub.Infrastructure.Push.IVapid _vapid;
 
-		public AppsController(IOpenIddictApplicationManager applications)
+		public AppsController(IOpenIddictApplicationManager applications, PrivaPub.Infrastructure.Push.IVapid vapid)
 		{
 			_applications = applications;
+			_vapid = vapid;
 		}
 
 		[HttpPost("/api/v1/apps"), AllowAnonymous]
@@ -69,7 +71,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				RedirectUris = redirects,
 				RedirectUri = string.Join("\n", redirects),
 				ClientId = descriptor.ClientId,
-				ClientSecret = descriptor.ClientSecret
+				ClientSecret = descriptor.ClientSecret,
+				VapidKey = (await _vapid.Key(token)).ForApi//Web Push's server key, as Mastodon still gives it here
 			});
 		}
 
@@ -88,7 +91,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				website = properties.TryGetValue("website", out var website) ? website.GetString() : default,
 				scopes = User.GetScopes().ToList(),
 				redirect_uris = (await _applications.GetRedirectUrisAsync(application, token)).ToList(),
-				vapid_key = string.Empty
+				vapid_key = (await _vapid.Key(token)).ForApi
 			});
 		}