feat: add web push notifications and file drop

Web Push:
- WebPushNotifier with VAPID auth; urgency mapped to event type
  (BLOCKED=urgent, FAILED=high, COMPLETED=low)
- Auto-generates VAPID keys on first serve, persists to config file
- push_subscriptions table in SQLite (upsert by endpoint)
- GET /api/push/vapid-key, POST/DELETE /api/push/subscribe endpoints
- Service worker (sw.js) handles push events and notification clicks
- Notification bell button in web UI; subscribes on click

File Drop:
- GET /api/drops, GET /api/drops/{filename}, POST /api/drops
- Persistent ~/.claudomator/drops/ directory
- CLAUDOMATOR_DROP_DIR env var passed to agent subprocesses
- Drops tab (📁) in web UI with file listing and download links

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 92 insertions, 0 deletions

diff --git a/internal/storage/db_test.go b/internal/storage/db_test.go
index 9b89e89..5c447af 100644
--- a/internal/storage/db_test.go
+++ b/internal/storage/db_test.go
@@ -1020,6 +1020,98 @@ func TestCreateTask_Project_RoundTrip(t *testing.T) {
 	}
 }
 
+// ── Push subscription tests ───────────────────────────────────────────────────
+
+func TestPushSubscription_SaveAndList(t *testing.T) {
+	db := testDB(t)
+
+	sub := PushSubscription{
+		ID:        "sub-1",
+		Endpoint:  "https://push.example.com/endpoint1",
+		P256DHKey: "p256dhkey1",
+		AuthKey:   "authkey1",
+	}
+	if err := db.SavePushSubscription(sub); err != nil {
+		t.Fatalf("SavePushSubscription: %v", err)
+	}
+
+	subs, err := db.ListPushSubscriptions()
+	if err != nil {
+		t.Fatalf("ListPushSubscriptions: %v", err)
+	}
+	if len(subs) != 1 {
+		t.Fatalf("want 1 subscription, got %d", len(subs))
+	}
+	if subs[0].Endpoint != sub.Endpoint {
+		t.Errorf("endpoint: want %q, got %q", sub.Endpoint, subs[0].Endpoint)
+	}
+	if subs[0].P256DHKey != sub.P256DHKey {
+		t.Errorf("p256dh_key: want %q, got %q", sub.P256DHKey, subs[0].P256DHKey)
+	}
+	if subs[0].AuthKey != sub.AuthKey {
+		t.Errorf("auth_key: want %q, got %q", sub.AuthKey, subs[0].AuthKey)
+	}
+}
+
+func TestPushSubscription_Delete(t *testing.T) {
+	db := testDB(t)
+
+	sub := PushSubscription{
+		ID:        "sub-del",
+		Endpoint:  "https://push.example.com/todelete",
+		P256DHKey: "key",
+		AuthKey:   "auth",
+	}
+	if err := db.SavePushSubscription(sub); err != nil {
+		t.Fatalf("SavePushSubscription: %v", err)
+	}
+
+	if err := db.DeletePushSubscription(sub.Endpoint); err != nil {
+		t.Fatalf("DeletePushSubscription: %v", err)
+	}
+
+	subs, err := db.ListPushSubscriptions()
+	if err != nil {
+		t.Fatalf("ListPushSubscriptions: %v", err)
+	}
+	if len(subs) != 0 {
+		t.Errorf("want 0 subscriptions after delete, got %d", len(subs))
+	}
+}
+
+func TestPushSubscription_UniqueEndpoint(t *testing.T) {
+	db := testDB(t)
+
+	sub := PushSubscription{
+		ID:        "sub-uq",
+		Endpoint:  "https://push.example.com/unique",
+		P256DHKey: "key1",
+		AuthKey:   "auth1",
+	}
+	if err := db.SavePushSubscription(sub); err != nil {
+		t.Fatalf("SavePushSubscription first: %v", err)
+	}
+
+	// Save again with same endpoint — should update or replace, not error.
+	sub2 := PushSubscription{
+		ID:        "sub-uq2",
+		Endpoint:  "https://push.example.com/unique",
+		P256DHKey: "key2",
+		AuthKey:   "auth2",
+	}
+	if err := db.SavePushSubscription(sub2); err != nil {
+		t.Fatalf("SavePushSubscription second (upsert): %v", err)
+	}
+
+	subs, err := db.ListPushSubscriptions()
+	if err != nil {
+		t.Fatalf("ListPushSubscriptions: %v", err)
+	}
+	if len(subs) != 1 {
+		t.Errorf("want 1 subscription after upsert, got %d", len(subs))
+	}
+}
+
 func TestExecution_StoreAndRetrieveChangestats(t *testing.T) {
 	db := testDB(t)
 	now := time.Now().UTC().Truncate(time.Second)