Web Push pipeline for stealth payment alerts

[truthixify]

Tier: M (2-4 days) | Type: feature

Context. Wave 7 shipped in-app notification history but delivery still depends on an open tab. Web Push over the existing stellar-notification-sw.ts reaches users when the app is closed. Keep it privacy-first: subscribe via a self-hostable relay whose URL the user can override in Settings.

Scope.

• Subscribe flow that requests the browser Notifications permission and registers a PushSubscription with a relay endpoint.
• Relay URL is user-configurable and defaults to the demo's own dev relay; docs cover self-hosting.
• Service worker handles push events, deduplicates against notification history.
• Unsubscribe from Settings; clear surfaces subscription state.

Acceptance.

• Push fires with the tab closed on Chrome desktop and Android Chrome
• Denied-permission path renders the fallback copy from the Wave 7 notification page
• No payload leaves the SW without at least the meta-address hash as the only identifier
• Unsubscribing removes the subscription from the relay

Files. src/sw/stellar-notification-sw.ts, src/hooks/useNotificationSW.ts, src/pages/Settings.tsx, src/lib/pushRelay.ts (new).