Add Web Push notifications, PWA support, and full-screen tablet kiosk

Parents get a real push notification when a kid checks off a task
(false->true transitions only, fire-and-forget, degrades gracefully with
no VAPID keys configured). Dashboard is a fully installable iOS/Android
PWA; each child's kiosk link gets its own dynamic per-token manifest so
"Add to Home Screen" opens straight into their board in standalone mode.

Kiosk view is reworked for tablets: safe-area-aware full-bleed layout,
the whole task row is now tappable (previously only the 24px checkbox
was, well under Apple's touch-target minimum), and app icons are
generated by a small dependency-free PNG encoder (no image tooling
available in this environment).

Push requires real HTTPS (iOS Safari won't allow it otherwise) - README
and UNRAID.md cover VAPID setup and the HTTPS prerequisite.

.env.example

@@ -16,3 +16,13 @@ DISABLE_PUBLIC_SIGNUP=false
 # DATA_DIR=./data
 
 # PORT=3007
+
+# Web Push (optional) — notifies parents when a kid checks off a task.
+# Requires real HTTPS with a browser-trusted certificate — self-signed does
+# NOT work on iOS, and plain HTTP doesn't work at all (see README's
+# "Push notifications" section). Leave unset to skip this feature; the
+# app degrades gracefully with no broken UI when it's not configured.
+# Generate with: npx web-push generate-vapid-keys
+# VAPID_PUBLIC_KEY=
+# VAPID_PRIVATE_KEY=
+# VAPID_SUBJECT=mailto:you@example.com