Notifications and sending songs to friends

Reactions to your songs, new followers, and songs sent to you are now
notifications: a bell on the feed (app and website) with an unread
count that updates live, and a list that marks them read. "Send ✉" on
a song sends it to people who follow you, with an optional note.
Settings picks which kinds to be notified about.

Push delivery uses no third-party accounts:
- Android: UnifiedPush through a distributor app (ntfy), pointed at
  our own ntfy server (docker-compose.ntfy.yml). Works the same in
  the F-Droid build; no Firebase.
- Browsers: standard Web Push from the existing service worker.
Both use Web Push encryption with a VAPID key pair the server makes
and keeps in the database. Push addresses are checked like any other
user-supplied URL. Setup is in docs/PUSH.md; the privacy page covers
the new data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.ntfy.yml

@@ -0,0 +1,41 @@
+# Your own push server for phone notifications (UnifiedPush via ntfy), so nothing goes
+# through Google. Add this file to the usual production command, e.g.:
+#
+#   docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.behind-proxy.yml \
+#     -f docker-compose.ntfy.yml --env-file deploy/production.env up -d
+#
+# Then point a subdomain (NTFY_DOMAIN, e.g. push.example.com) at 127.0.0.1:${NTFY_PORT:-3739} in your
+# reverse proxy, with websockets on. ntfy can't live under a path like /push. See docs/PUSH.md.
+services:
+  ntfy:
+    image: binwiederhier/ntfy:v2.30.0
+    command: serve
+    restart: unless-stopped
+    environment:
+      NTFY_BASE_URL: https://${NTFY_DOMAIN:?set NTFY_DOMAIN in production.env}
+      NTFY_BEHIND_PROXY: 'true'
+      # Keep messages for phones that are offline for a while.
+      NTFY_CACHE_FILE: /var/cache/ntfy/cache.db
+      NTFY_CACHE_DURATION: 24h
+      # Private server: nobody can use it for anything except UnifiedPush topics ("up" + a long
+      # random name only the phone and our server know).
+      NTFY_AUTH_FILE: /var/lib/ntfy/auth.db
+      NTFY_AUTH_DEFAULT_ACCESS: deny-all
+      NTFY_AUTH_ACCESS: '*:up*:rw'
+      NTFY_ENABLE_SIGNUP: 'false'
+      NTFY_ENABLE_LOGIN: 'false'
+      NTFY_WEB_ROOT: disable
+    volumes:
+      - ntfy_cache:/var/cache/ntfy
+      - ntfy_lib:/var/lib/ntfy
+    ports:
+      - "${PROXY_BIND:-127.0.0.1}:${NTFY_PORT:-3739}:80"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -q '\"healthy\":true'"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+
+volumes:
+  ntfy_cache:
+  ntfy_lib: