Web Push: goal, kickoff and full-time alerts for a followed team

Fully progressive: without VAPID keys in the environment the API says
404, the bell never renders, and the service worker addition (a push
handler via workbox importScripts — no SW strategy change) is inert.
With keys: a bell on each team page requests permission, subscribes
(one team per device) and the server diffs fixture states on every
broadcast to push Kickoff / Goal / Full time to that team's followers.
Dead endpoints (404/410) self-clean. Round-trip verified locally with
dev VAPID keys; disabled mode verified too.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/cup26.compose.yml

@@ -21,6 +21,11 @@ services:
       - ENABLE_SOFASCORE=${ENABLE_SOFASCORE:-false}
       - ENABLE_FOTMOB=${ENABLE_FOTMOB:-false}
       - ARCHIVE_DIR=/data/archive
+      # Web Push (optional): goal/kickoff alerts. Generate once with
+      # `npx web-push generate-vapid-keys`; absent keys = feature hidden.
+      - VAPID_PUBLIC_KEY=${VAPID_PUBLIC_KEY:-}
+      - VAPID_PRIVATE_KEY=${VAPID_PRIVATE_KEY:-}
+      - VAPID_SUBJECT=${VAPID_SUBJECT:-}
     volumes:
       # The LIVE SQLite must stay on a real local filesystem (WAL + locking do
       # not survive network mounts). HOST_DATA_DIR can override if ever needed.