Wire Web Push broadcaster: lock-screen pushes ride the in-app notifications

- nuget.config with Soroush Nexus + Liara mirrors (nuget.org filtered); added WebPush 1.0.12
- PushNotifier: VAPID send to a user's subscriptions, prunes dead (404/410); config from AppSetting
- NotificationService fans out a Web Push to matched users' subscribed browsers after creating in-app notifications (best-effort; no-op until admin enables push + sets VAPID)
- Build verified through the mirrors; app boots with PushNotifier wired

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nuget.config

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <!-- Soroush Nexus mirror (primary) + Liara mirror (fallback) — nuget.org is filtered. -->
+    <add key="nexus" value="https://mirror.soroushasadi.com/repository/nuget-group/index.json" protocolVersion="3" />
+    <add key="liara" value="https://package-mirror.liara.ir/repository/nuget/index.json" protocolVersion="3" />
+  </packageSources>
+  <config>
+    <add key="http_retry_count" value="6" />
+    <add key="http_retry_delay_milliseconds" value="1000" />
+  </config>
+</configuration>