feat(05-01): add push_subscriptions table + calendar_events.title column; VAPID env wiring

- schema.ts: new pushSubscriptions mysqlTable (user_id FK cascade, endpoint unique, p256dh, auth)
- schema.ts: add nullable title varchar(500) to calendarEvents after rawVevent (D-02/NOTIF-01)
- 0003_same_xavin.sql: CREATE TABLE push_subscriptions + ALTER calendar_events ADD title
- migration applied to dev DB via db:generate + db:migrate (NOT db:push per anti-pattern)
- docker-compose.yml: inject VAPID_PUBLIC_KEY/PRIVATE_KEY/SUBJECT into api environment block
- .env.example: document all three VAPID vars with placeholders + generation instructions

docker-compose.yml

@@ -23,6 +23,12 @@ services:
       # persistence (D-12/AUTH-02) and must also be allowed on the Authelia client.
       OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email offline_access}
       APP_PASSWORD_ENCRYPTION_KEY: ${APP_PASSWORD_ENCRYPTION_KEY:-}
+      # VAPID keys for Web Push notifications (Phase 5).
+      # Generate with: npx web-push generate-vapid-keys --json
+      # Private key must only live in the gitignored .env — never commit it.
+      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
+      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
+      VAPID_SUBJECT: ${VAPID_SUBJECT}
     depends_on:
       mariadb:
         condition: service_healthy