R9 Web Push in decePub: one subscription per persona, each with its own token and registration

Settings gets "Notifications on this device" (PushEditor): personas, alerts in four groups, policy, a test
notification, after a one-time notice of what the push service learns. Each persona ticked gets its own service
worker registration (push-worker.js at push/{slot}/), so its own endpoint and keys, subscribed with its own token
(IHttpService's *As); nothing PrivaPub stores ties two personas together and the worker never reads the payload's
token. PushService follows the tokens (re-subscribing after a renewal), reconciles at every session start, turns
off before sign-out and drops deleted or suspended personas. A click opens that persona's notifications; the app
badge counts the unread ones. Exchanges now ask for the push scope.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

Services/AuthService.cs

@@ -161,6 +161,35 @@ namespace decePubClient.Services
 			return response.IsSuccessStatusCode ? new() : await response.Content.ReadWebResult(response.StatusCode, localizer, cancellationToken);
 		}
 
+		/// <summary>
+		/// Revokes the persona's token and forgets it, so the next request as the persona exchanges a new one with the scopes
+		/// the client asks for now (APIs.OAuth.Scopes): a token exchanged before the client asked for push can't subscribe to
+		/// Web Push (PrivaPub's 403). The persona stays current if it was.
+		/// </summary>
+		public async Task<WebResult> RenewPersonaToken(string personaId, CancellationToken cancellationToken = default)
+		{
+			var result = new WebResult();
+			var session = await authStateProvider.GetAuthData(cancellationToken);
+			if (session.PersonaTokens.GetValueOrDefault(personaId) is not { Length: > 0 } token)
+				return result;
+
+			// forgotten first, so no request uses it while it is revoked
+			await authStateProvider.ForgetPersonaToken(personaId, cancellationToken);
+			using var revoked = await httpService.PostTotallyAnon(APIs.OAuth.POST_Revoke, new Dictionary<string, string>
+			{
+				["token"] = token,
+				["client_id"] = appConfiguration.ClientId
+			}, cancellationToken: cancellationToken);
+			if (!revoked.IsSuccessStatusCode)
+			{
+				result = await revoked.Content.ReadWebResult(revoked.StatusCode, localizer, cancellationToken);
+				await logger.ProcessWarning(result.ToString(localizer), $"{nameof(AuthService)}.{nameof(RenewPersonaToken)}", cancellationToken);
+				return result;
+			}
+
+			return result;
+		}
+
 		/// <summary>The current persona's Mastodon account, or null.</summary>
 		public async Task<Account> CurrentAccount(CancellationToken cancellationToken = default)
 		{