P4-C: PWA installable, service worker push & campagne de fiabilité dialogues

- PWA: public/manifest.webmanifest + icon.svg + meta index.html (theme-color, apple-touch-icon)
- public/sw.js: service worker push-only (push → showNotification tag=sessionId ;
  notificationclick → focus/ouvre /sessions/<id>) — pas de précache (hors périmètre)
- lib/push.ts + stores/push.ts: enable/disable, abonnement VAPID, enregistrement SW au boot
- DashboardView: toggle « Notifications » (gardé par pushSupported) + i18n en/fr
- campagne de fiabilité (verdict S3): classification de tous les types de dialogue sur captures
  réelles (trust/permission×2/question) + refus Esc (deny-esc2) + plan (synthétique)
- acceptance-p4.mjs: VAPID/auth/Origin, subscribe idempotent/unsubscribe, answer (rejets)

Choix: SW écrit à la main plutôt que vite-plugin-pwa (qui tirait ~295 paquets Workbox +
2 vulns esbuild high pour un SW push-only). Zéro dépendance front nouvelle. 175 tests verts,
acceptance p1..p4 ALL GREEN.

packages/web/src/stores/push.ts

@@ -0,0 +1,42 @@
+import { defineStore } from 'pinia';
+import { ref } from 'vue';
+import { currentSubscription, disablePush, enablePush, notificationPermission, pushSupported } from '../lib/push';
+
+export const usePushStore = defineStore('push', () => {
+  const supported = ref(pushSupported());
+  const enabled = ref(false);
+  const busy = ref(false);
+  /** null | 'denied' | 'unsupported' | message d'erreur */
+  const error = ref<string | null>(null);
+
+  async function refresh(): Promise<void> {
+    supported.value = pushSupported();
+    if (!supported.value) {
+      enabled.value = false;
+      return;
+    }
+    enabled.value = notificationPermission() === 'granted' && (await currentSubscription()) !== null;
+  }
+
+  async function toggle(): Promise<void> {
+    if (busy.value || !supported.value) return;
+    busy.value = true;
+    error.value = null;
+    try {
+      if (enabled.value) {
+        await disablePush();
+        enabled.value = false;
+      } else {
+        const r = await enablePush();
+        enabled.value = r === 'enabled';
+        if (r !== 'enabled') error.value = r;
+      }
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : String(e);
+    } finally {
+      busy.value = false;
+    }
+  }
+
+  return { supported, enabled, busy, error, refresh, toggle };
+});