Browser-native push notifications for desktop and mobile - works without an app install. Add a /sw.js service worker, generate VAPID key pair (env vars), expose a small client API to request permission and subscribe; persist subscriptions in a push_subscriptions table (user_id, endpoint, p256dh_key, auth_key, user_agent, created_at, last_seen_at). On every notifications insert that has the push channel enabled, fan out via web-push to active subscriptions; prune on 410 Gone.

Per-device unsubscribe in the user account settings. Browser permission prompt is gated behind an explicit user click - never on page load. Supports rich payloads (icon, badge, action buttons "Open" / "Mark read"). Out of scope: native iOS/Android push (handled separately if a native app ever ships), in-page toasts (live view card already covers that).