Add Web Push notifications, PWA support, and full-screen tablet kiosk

Parents get a real push notification when a kid checks off a task
(false->true transitions only, fire-and-forget, degrades gracefully with
no VAPID keys configured). Dashboard is a fully installable iOS/Android
PWA; each child's kiosk link gets its own dynamic per-token manifest so
"Add to Home Screen" opens straight into their board in standalone mode.

Kiosk view is reworked for tablets: safe-area-aware full-bleed layout,
the whole task row is now tappable (previously only the 24px checkbox
was, well under Apple's touch-target minimum), and app icons are
generated by a small dependency-free PNG encoder (no image tooling
available in this environment).

Push requires real HTTPS (iOS Safari won't allow it otherwise) - README
and UNRAID.md cover VAPID setup and the HTTPS prerequisite.

src/config.js

@@ -9,4 +9,10 @@ module.exports = {
   sessionSecret: process.env.SESSION_SECRET || 'dev-secret-change-me',
   cookieSecure: process.env.COOKIE_SECURE === 'true',
   disablePublicSignup: process.env.DISABLE_PUBLIC_SIGNUP === 'true',
+  vapidPublicKey: process.env.VAPID_PUBLIC_KEY || null,
+  vapidPrivateKey: process.env.VAPID_PRIVATE_KEY || null,
+  vapidSubject: process.env.VAPID_SUBJECT || null,
+  get pushConfigured() {
+    return Boolean(this.vapidPublicKey && this.vapidPrivateKey && this.vapidSubject);
+  },
 };