Push notification reliability improvements

A malformed VAPID key no longer breaks every notification send — it degrades gracefully and is logged once. Batch sends no longer fail if pruning a stale subscription hits an error, and the push toggle now surfaces an inline hint when the browser blocks permission or the unsubscribe request fails.