Stage 15 — PWA complete: install prompt + Web Push notifications

Dependency:
- minishlink/web-push v10 (VAPID JWT + aes128gcm payload encryption)
- Dockerfile: add curl, mbstring, gmp extensions (web-push needs ext-curl)

VAPID:
- config/webpush.php from env; `php artisan push:vapid` generates keypair
- Shared platform keypair; .env.example has empty placeholders

Schema:
- push_subscriptions (user/company, endpoint unique, p256dh, auth, encoding)

WebPushService:
- send / sendToUser / dispatch via WebPush::flush
- Auto-prunes subscriptions reported expired (404/410)

Subscribe flow:
- POST /push/subscribe + /push/unsubscribe (auth, tenant)
- Tenant panel JS subscribes after SW registration with VAPID public key

Service worker (/sw.js):
- Cache v2, push listener → showNotification, notificationclick → focus/open

Install prompt:
- Floating "Instalează aplicația" button wired to beforeinstallprompt

Staff push:
- WorkOrder master_id change → push to assigned mechanic
- Settings "Test notificare push" action

Tests (6 new):
- subscribe stores + upserts; requires auth (401); validation (422);
  service configured; sendToUser with no subs returns zero

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/Filament/Tenant/Pages/Settings.php

@@ -245,6 +245,31 @@ class Settings extends Page
     protected function getHeaderActions(): array
     {
         return [
+            Actions\Action::make('push_test')
+                ->label('Test notificare push')
+                ->icon('heroicon-m-bell-alert')
+                ->color('gray')
+                ->action(function () {
+                    $svc = app(\App\Services\Notifications\WebPushService::class);
+                    if (! $svc->configured()) {
+                        Notification::make()
+                            ->title('Web Push neconfigurat')
+                            ->body('Rulează `php artisan push:vapid` și adaugă cheile în .env.')
+                            ->warning()->send();
+                        return;
+                    }
+                    $r = $svc->sendToUser(
+                        (int) auth()->id(),
+                        'Test AutoCRM',
+                        'Notificările push funcționează ✅',
+                        '/app',
+                    );
+                    Notification::make()
+                        ->title($r['sent'] > 0 ? "Trimis pe {$r['sent']} dispozitiv(e)" : 'Niciun dispozitiv abonat')
+                        ->body($r['sent'] > 0 ? null : 'Deschide panoul pe telefon și acceptă notificările întâi.')
+                        ->{$r['sent'] > 0 ? 'success' : 'warning'}()
+                        ->send();
+                }),
             Actions\Action::make('telegram_test')
                 ->label('Testează bot Telegram')
                 ->icon('heroicon-m-bolt')