R9 Web Push in decePub: one subscription per persona, each with its own token and registration

Settings gets "Notifications on this device" (PushEditor): personas, alerts in four groups, policy, a test
notification, after a one-time notice of what the push service learns. Each persona ticked gets its own service
worker registration (push-worker.js at push/{slot}/), so its own endpoint and keys, subscribed with its own token
(IHttpService's *As); nothing PrivaPub stores ties two personas together and the worker never reads the payload's
token. PushService follows the tokens (re-subscribing after a renewal), reconciles at every session start, turns
off before sign-out and drops deleted or suspended personas. A click opens that persona's notifications; the app
badge counts the unread ones. Exchanges now ask for the push scope.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

Models/PushDevice.cs

@@ -0,0 +1,54 @@
+using decePubClient.Models.Types;
+
+namespace decePubClient.Models
+{
+	/// <summary>
+	/// Web Push on this device (Services/PushService.cs), kept in localStorage under its type name: the personas whose
+	/// notifications reach it, and the alerts and policy each of their subscriptions holds. Never a token: each persona's
+	/// subscription is made with that persona's own token, which only AuthData keeps.
+	/// </summary>
+	public class PushDevice
+	{
+		/// <summary>The personas subscribed on this device, each through its own service worker registration.</summary>
+		public List<PushPersona> Personas { get; set; } = [];
+		/// <summary>The alerts turned on (PushAlerts.Offered's names).</summary>
+		public List<string> Alerts { get; set; } = [.. PushAlerts.Offered];
+		public PushPolicy Policy { get; set; } = PushPolicy.All;
+	}
+
+	/// <summary>One persona's subscription on this device.</summary>
+	public class PushPersona
+	{
+		/// <summary>The persona's avatar id.</summary>
+		public string PersonaId { get; set; }
+		/// <summary>A random name this device gives the persona's service worker registration (its scope is push/{slot}/), so
+		/// the persona's subscription has an endpoint and keys of its own; it means nothing anywhere else.</summary>
+		public string Slot { get; set; }
+		/// <summary>PrivaPub's id for the subscription, as it last answered.</summary>
+		public string SubscriptionId { get; set; }
+	}
+
+	/// <summary>What js/push.js says of this browser: whether it can be pushed to, why not (insecure, unsupported, or
+	/// ios-install: an iPhone or iPad pushes only to the app added to the Home Screen), and what the reader allowed.</summary>
+	public class PushSupport
+	{
+		public bool Supported { get; set; }
+		public string Reason { get; set; }
+		/// <summary>default, granted or denied (Notification.permission).</summary>
+		public string Permission { get; set; }
+
+		public bool IsGranted => Permission == "granted";
+		public bool IsDenied => Permission == "denied";
+	}
+
+	/// <summary>A persona's push subscription in this browser, as js/push.js reads it (its keys URL-safe base64), or why it
+	/// couldn't be made.</summary>
+	public class BrowserSubscription
+	{
+		public string Endpoint { get; set; }
+		public string P256dh { get; set; }
+		public string Auth { get; set; }
+		public bool Standard { get; set; }
+		public string Error { get; set; }
+	}
+}