Fetch the dispatcher's VAPID application-server public key

Returns the base64url-encoded application-server public key the SPA must pass to PushManager.subscribe({applicationServerKey}) before posting the resulting subscription to POST /api/v1/push/subscribe. The key is the public half of a VAPID keypair generated on the dispatcher's first boot and persisted thereafter — not a secret, but auth-gated so the SPA already has a token by the time it asks. Returns 503 in the defensive case where the dispatcher router is up but the keypair has not been initialised yet (not reachable on the current boot order).