Add push reminders for sleep, pee, poo and meals

A closed PWA has no timers, so reminders are evaluated on the server: the
event log is already there (clients sync on every mutation), and a ticker
re-checks each enabled rule once a minute and pushes the ones that are due.

Two rule shapes. "sleep" measures from the last sleep-end and fires only
while the puppy is awake. "pee"/"poo"/"eat" measure from the newest event of
that type and stay quiet while the puppy is asleep — otherwise they nag all
night, and suppressing them means an overdue rule instead fires promptly on
waking, which is when it actually matters. Sleep state is derived exactly the
way currentSleepState() does in app.js, tie-break included, so both sides
always agree. Rules read the event's own timestamp rather than when it synced,
so a pee logged offline at 03:10 cancels the reminder retroactively.

Every push carries a tag, so a repeat replaces the previous notification
instead of stacking another one on the lock screen. last_fired is server-owned
and not writable by a client, so a stale device can't force a re-fire.

Web Push is implemented directly rather than pulled in as a dependency: RFC
8291 encryption in the RFC 8188 aes128gcm coding with an RFC 8292 VAPID token,
stdlib only, checked against the RFC 8291 test vector. The key is generated
into vapid.json beside the DB or supplied via -vapid-key; without one the
server logs a warning, skips registering the routes, and the client hides the
UI. Subscriptions a push service reports as 404/410 are dropped.

PNG icons are added because iOS gates push on a Home Screen install and
rejects SVG for apple-touch-icon, and Android has no notification icon
without them.

server/auth.go

@@ -395,8 +395,9 @@ func (a *Auth) checkPassword(userID, password string) bool {
 }
 
 // deleteAccount removes a user and everything owned by them: events, profile,
-// sessions, the user row, and their photo directory. The table wipes run in one
-// transaction; photos are best-effort afterwards (orphaned files are harmless).
+// reminders, push subscriptions, sessions, the user row, and their photo
+// directory. The table wipes run in one transaction; photos are best-effort
+// afterwards (orphaned files are harmless).
 func (a *Auth) deleteAccount(userID string) error {
 	tx, err := a.db.Begin()
 	if err != nil {
@@ -407,6 +408,8 @@ func (a *Auth) deleteAccount(userID string) error {
 		`DELETE FROM events WHERE user_id = ?`,
 		`DELETE FROM exercises WHERE user_id = ?`,
 		`DELETE FROM config WHERE user_id = ?`,
+		`DELETE FROM push_subscriptions WHERE user_id = ?`,
+		`DELETE FROM reminders WHERE user_id = ?`,
 		`DELETE FROM sessions WHERE user_id = ?`,
 		`DELETE FROM users WHERE id = ?`,
 	} {