R9 Web Push, then the honest version: VAPID key, push subscriptions, encrypted pushes, 4.5.0 advertised

The server's VAPID key (PushKeys, made on first need, in Mongo) is the instance API's vapid.public_key and every app's
vapid_key. /api/v1/push/subscription (POST, GET, PUT, DELETE) keeps one subscription per access token, so per persona;
every notification kept (never a filtered one) is queued as a SendPush job for the subscriptions whose alert and policy
admit it, and sent through the `push` client (the safe handler, https only) encrypted as RFC 8291 aes128gcm or the
aesgcm draft with an ES256 VAPID JWT. 404/410 delete the subscription, 429/5xx/timeouts retry, other answers drop the
push. Subscriptions end with their tokens (revocation, sessions ended, suspension, deletion, a restore); backups hold
neither keys nor subscriptions. The walk of every Mastodon 4.3-4.5 client route (docs/MASTODON-API.md) added
conversations/:id/unread, domain_blocks/preview, v2 notifications clear and PUT policy, /oauth/userinfo and stubs, so both
instance APIs now say 4.5.0 (compatible; PrivaPub <release>). The pasture gets a push sink (pushsink.test) and
scenarios/push.sh in batch A.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Controllers/InstanceController.cs

@@ -28,7 +28,19 @@ namespace PrivaPub.Api.Mastodon.Controllers
 	// are enforced.
 	public class InstanceController : MastodonController
 	{
-		public const string Version = "4.2.0 (compatible; PrivaPub)";
+		// The Mastodon version this API answers as, then PrivaPub's own release (its tag, or the commit a build came from).
+		// 4.5.0 since R9 (2026-10-18): every client route of Mastodon 4.3, 4.4 and 4.5 is served or answers as a documented
+		// stub (docs/MASTODON-API.md), streaming and Web Push included. api_versions.mastodon is 4.5's own, 7.
+		public const string MastodonVersion = "4.5.0";
+		public static readonly string Version = Advertised(string.IsNullOrEmpty(BuildInfo.Ref) ? BuildInfo.Commit : BuildInfo.Ref);
+
+		static string Advertised(string release)
+		{
+			var own = release?.Trim();
+			if (own is { Length: > 1 } && own[0] == 'v' && char.IsDigit(own[1]))
+				own = own[1..];//a tag v1.27.0 is release 1.27.0
+			return string.IsNullOrEmpty(own) ? $"{MastodonVersion} (compatible; PrivaPub)" : $"{MastodonVersion} (compatible; PrivaPub {own})";
+		}
 		const int ActivityWeeks = 12;
 		static readonly TimeSpan ActivityLifetime = TimeSpan.FromHours(1);
 		static volatile CachedActivity _activity;
@@ -39,14 +51,16 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		readonly IOptionsMonitor<RegistrationOptions> _registrations;
 		readonly IInstanceSettings _settings;
 		readonly MastodonMapper _mapper;
+		readonly PrivaPub.Infrastructure.Push.IVapid _vapid;
 
 		public InstanceController(ILocalActorService localActors, IOptionsMonitor<RegistrationOptions> registrations, IInstanceSettings settings,
-			MastodonMapper mapper)
+			MastodonMapper mapper, PrivaPub.Infrastructure.Push.IVapid vapid)
 		{
 			_localActors = localActors;
 			_registrations = registrations;
 			_settings = settings;
 			_mapper = mapper;
+			_vapid = vapid;
 		}
 
 		bool Open => _registrations.CurrentValue.IsOpen;
@@ -165,7 +179,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				statuses = Statuses,
 				media_attachments = MediaAttachments,
 				polls = Polls,
-				translation = new { enabled = false }
+				translation = new { enabled = false },
+				vapid = new { public_key = (await _vapid.Key(token)).ForApi }//Web Push (R9): the key every push is signed with
 			},
 			registrations = new { enabled = Open, approval_required = false, message = Open ? default : RegistrationOptions.ClosedMessage },
 			contact = new { email = Settings.ContactEmail ?? string.Empty, account = await ContactAccount(Settings, token) },