Create or update a push subscription (upsert by endpoint).

A push endpoint is a browser-level resource — the same physical push channel regardless of which user subscribed. The lookup uses endpoint alone (matching the model's unique constraint) so that if a different user subscribes from the same browser, the subscription is reassigned to them rather than creating a duplicate that would cause the browser to show the same notification twice.