R9 Web Push, then the honest version: VAPID key, push subscriptions, encrypted pushes, 4.5.0 advertised

The server's VAPID key (PushKeys, made on first need, in Mongo) is the instance API's vapid.public_key and every app's
vapid_key. /api/v1/push/subscription (POST, GET, PUT, DELETE) keeps one subscription per access token, so per persona;
every notification kept (never a filtered one) is queued as a SendPush job for the subscriptions whose alert and policy
admit it, and sent through the `push` client (the safe handler, https only) encrypted as RFC 8291 aes128gcm or the
aesgcm draft with an ES256 VAPID JWT. 404/410 delete the subscription, 429/5xx/timeouts retry, other answers drop the
push. Subscriptions end with their tokens (revocation, sessions ended, suspension, deletion, a restore); backups hold
neither keys nor subscriptions. The walk of every Mastodon 4.3-4.5 client route (docs/MASTODON-API.md) added
conversations/:id/unread, domain_blocks/preview, v2 notifications clear and PUT policy, /oauth/userinfo and stubs, so both
instance APIs now say 4.5.0 (compatible; PrivaPub <release>). The pasture gets a push sink (pushsink.test) and
scenarios/push.sh in batch A.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Controllers/TimelinesController.cs

@@ -177,6 +177,18 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			return Json(conversation ?? new Conversation { Id = group.ID });
 		}
 
+		// Mastodon's unread (R9): shown unread again until it is read
+		[HttpPost("/api/v1/conversations/{id}/unread"), Scope("write:conversations")]
+		public async Task<IActionResult> UnreadConversation(string id, CancellationToken token)
+		{
+			var group = await MyConversation(id, token);
+			if (group == default)
+				return NotFoundError();
+			await ConversationStates.Unread(MyId, group.ID, token);
+			var conversation = (await ConversationsOf(new List<DmGroup> { group }, token)).FirstOrDefault();
+			return Json(conversation ?? new Conversation { Id = group.ID, Unread = true });
+		}
+
 		// off the persona's list until a newer message; the messages themselves stay
 		[HttpDelete("/api/v1/conversations/{id}"), Scope("write:conversations")]
 		public async Task<IActionResult> RemoveConversation(string id, CancellationToken token)
@@ -410,7 +422,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			return mapped == default ? NotFoundError() : Json(mapped);
 		}
 
-		[HttpPost("/api/v1/notifications/clear"), Scope("write:notifications")]
+		[HttpPost("/api/v1/notifications/clear"), HttpPost("/api/v2/notifications/clear"), Scope("write:notifications")]
 		public async Task<IActionResult> Clear(CancellationToken token)
 		{
 			await DB.Default.DeleteAsync<NotificationEntity>(n => n.AvatarId == MyId);