feat: add webchat pwa push subscription support

README.md

@@ -1328,6 +1328,28 @@ Companion runtime helper:
   - runtime observability/control passthroughs (`pendingRequestCount`, `pendingEventWaitCount`, `hasPendingWork`, `idle`, `lastDisconnectCode`, `lastDisconnectReason`, `getPendingWorkSnapshot()`, `getEventSurfaceSnapshot()`, `getConnectionSnapshot()`, `connected`, `waitForIdle()`)
 - `src/companion/heartbeatLoop.ts` provides `CompanionHeartbeatLoop` for periodic heartbeat scheduling (`publishHeartbeat`) with start/stop safety, optional interval jitter (`jitterRatio`) to spread load (with safe normalization for invalid random samples), `tickNow()` for manual sends, success/error hooks, loop observability (`successCount`, `lastSuccessAt`, `failureCount`, `lastFailure`, `getState()`), and optional auto-stop after repeated failures.
 
+## WebChat PWA Push Subscriptions
+
+Enable installable WebChat PWA metadata and browser push-subscription storage on the gateway:
+
+```yaml
+server:
+  webchat_push:
+    enabled: true
+    vapid_public_key: ${WEBCHAT_VAPID_PUBLIC_KEY}
+    max_subscriptions: 5000
+```
+
+Notes:
+- WebChat now serves `manifest.webmanifest` and a service worker (`/sw.js`).
+- Settings page includes Push controls (Enable/Disable) that subscribe the current browser and register/unregister its endpoint with the gateway.
+- Gateway endpoints:
+  - `GET /webchat/push/public-key`
+  - `GET /webchat/push/subscriptions`
+  - `POST /webchat/push/subscriptions`
+  - `DELETE /webchat/push/subscriptions`
+- These endpoints are protected by normal gateway HTTP auth (`server.token` + `server.auth_http`) and support `?token=` query auth for browser clients.
+
 ## Canvas / A2UI Foundation
 
 Gateway provides a session-scoped canvas artifact API for companion/UI surfaces: