feat: notifications on Android while closed, with nothing to install

The phone fetches what is new every fifteen minutes with a poll secret
(POST /v1/push/poll) that reads notification lines and nothing else. When a
UnifiedPush distributor is already installed, the hub also pushes at once,
encrypted to the phone (RFC 8291); losing the distributor falls back to
fetching.

The hub now honours "disable all notifications" itself: create_notification
creates nothing for that account, as it already did for a muted group, so
neither switch lets anything reach a phone. The interface used to be the only
reader of the account-wide switch.

Push endpoints are member-supplied URLs: a send refuses non-public
addresses, connects to the address it checked, and follows no redirect.

Android build untested here (no SDK on this machine).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 13 insertions, 1 deletions

diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index 275a70d..eb659e1 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -447,6 +447,16 @@ designed and not built.
 **Settings → Defaults** — which tab a group opens on, how many items per page.
 **Settings → Appearance** — theme and language (ten languages ship).
 **Group menu → Mute** — stop notifications for one group.
+**Settings → Groups → Disable all notifications** — none are kept for you at
+all, and none reach a phone.
+**Settings → Groups → Notifications on this phone** (Android application) —
+be told about new messages and invitations while MeshBay is closed. Nothing to
+install: the phone checks about every fifteen minutes (Android may wait longer
+when the phone is asleep). If you want them to arrive at once, install a
+UnifiedPush *distributor* app such as **ntfy** (Play Store or F-Droid) — optional;
+MeshBay then uses it by itself, encrypted so the distributor cannot read what it
+carries. Muting a group, or disabling all notifications, stops what reaches the
+phone too. A busy conversation is one line per group.
 
 ---
 
@@ -1008,7 +1018,9 @@ Better to know now than to go looking for it:
 - **The Android application is not released yet.** It works — groups, chat,
   films, downloads, casting — and is signed with the release key, but is
   installed by hand from an APK: there is no store page and no update channel. The
-  back button and the lock screen do not drive it yet. Music keeps playing
+  back button and the lock screen do not drive it yet. Notifications arrive within about
+  fifteen minutes, or at once with a UnifiedPush distributor app such as ntfy
+  — except one that demands a server key (VAPID), not supported yet. Music keeps playing
   with the screen off, from one track to the next, with a notification shown
   while it plays. A phone browser works too.
 - **A node cannot be hosted on Android**, and is not planned to be.