Register a browser Web Push subscription

Persists the browser's PushSubscription object so the dispatcher can deliver notifications on monitor state transitions. The p256dh and auth fields are write-only secrets used server-side to encrypt push payloads — they are NEVER returned in the response. The 64 KB body limit and the global per-account 200/min rate limiter both apply. Per-account cap is enforced atomically: an account holds exactly 20 active subscriptions at steady state — concurrent subscribes never produce a 21st row. The 21st insert evicts the oldest by created_at (FIFO). The endpoint must be an https:// URL with a public hostname; private/loopback/link-local/mDNS endpoints are rejected with 400 {"error":"endpoint must be HTTPS"} (SSRF hardening).