feat: notifications on Android while closed, with nothing to install

The phone fetches what is new every fifteen minutes with a poll secret
(POST /v1/push/poll) that reads notification lines and nothing else. When a
UnifiedPush distributor is already installed, the hub also pushes at once,
encrypted to the phone (RFC 8291); losing the distributor falls back to
fetching.

The hub now honours "disable all notifications" itself: create_notification
creates nothing for that account, as it already did for a muted group, so
neither switch lets anything reach a phone. The interface used to be the only
reader of the account-wide switch.

Push endpoints are member-supplied URLs: a send refuses non-public
addresses, connects to the address it checked, and follows no redirect.

Android build untested here (no SDK on this machine).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index b9466d0..2254a11 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -31,6 +31,7 @@ import {
 } from './playlists.js';
 import { IndexingDock } from './index-dock.js';
 import { SettingsPage } from './settings-page.js';
+import { syncPush, disablePush } from './push.js';
 import { ProfilePage } from './profile-page.js';
 import { ExplorePage } from './explore-page.js';
 import { GroupName } from './group-name.js';
@@ -1042,6 +1043,7 @@ function App() {
       .catch(() => {});
     refreshNodeKey();
     fetchNotifications();
+    syncPush(user).catch(() => {});
   }, [user]);
 
   // The node this application ships, set up, started and linked for whoever
@@ -1233,6 +1235,13 @@ function App() {
       // Navigating away leaves transfers running; signing out does not. They
       // are moving data on tokens that are about to stop being ours.
       transfers.reset();
+      // This phone stops being told about the account it is leaving. Its
+      // access token is still good for that request; the refresh token's
+      // revocation below does not touch it.
+      // The stored session, read now: React's copy can be a renewal behind,
+      // and once the session is cleared nothing could renew it.
+      disablePush(user && { ...user, token: (loadAuth() || {}).token || user.token })
+        .catch(() => {});
       // Revoked on the hub too, so a copy of the refresh token is worth
       // nothing. Read before the next line clears it.
       logoutOnHub();