feat(05-04): push subscription API + VAPID startup wiring

- Create apps/api/src/routes/push.ts: GET /vapid-public-key, POST /subscription (upsert), DELETE /subscription (user-scoped)
- Wire pushRouter at /api/push in index.ts
- Call webpush.setVapidDetails() in isMainModule() guard before serve()
- Fix broken vi.getMockImplementation scaffold bug in push.test.ts (Rule 1)
- push.test.ts: all 4 tests GREEN

apps/api/tests/routes/push.test.ts

@@ -103,15 +103,15 @@ describe('GET /api/push/vapid-public-key', () => {
 
 describe('POST /api/push/subscription', () => {
   it('returns 401 when unauthenticated', async () => {
-    // Temporarily override the mock to simulate unauthenticated state
-    vi.mocked(vi.getMockImplementation).mockImplementation?.(() => undefined)
-
-    // Replace devBypass mock to inject no user (simulate 401)
+    // Simulate unauthenticated state: devBypass injects no user (passthrough only),
+    // and OIDC getAuth returns null — so resolveUserId returns null → 401.
     vi.doMock('../../src/auth/devBypass.js', () => ({
       devAuthBypass: () => async (_c: unknown, next: () => Promise<void>) => next(),
     }))
     vi.doMock('../../src/auth/middleware.js', () => ({
       getAuth: () => null,
+      oidcAuthMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
+      processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) => c.json({ ok: true }),
     }))
 
     const { app: freshApp } = await import('../../src/index.js?v=unauth')