feat: Web Push 비활성 운영 설정을 준비한다

VAPID private key를 Compose secret으로 주입하고 Web Push를 기본 비활성으로 전달한다. 활성화 입력과 Compose 모델 검증, 운영 README를 함께 추가한다.

.env.example

@@ -86,6 +86,16 @@ GATEWAY_ADMIN_LOCAL_ACCOUNT_ENABLED=true
 GATEWAY_LOCAL_ACCOUNT_GRACE_DAYS=7
 GATEWAY_LEGACY_PASSWORD_GLOBAL_SALT=
 
+# Web Push is intentionally off until a VAPID key pair and contact subject are
+# configured. The private key file is mounted as a Compose secret and must not
+# be committed. The public key is safe to expose to browsers.
+WEB_PUSH_ENABLED=false
+WEB_PUSH_VAPID_SUBJECT=mailto:admin@example.com
+WEB_PUSH_VAPID_PUBLIC_KEY=
+WEB_PUSH_VAPID_PRIVATE_KEY_FILE=./secrets/web_push_vapid_private_key.example
+WEB_PUSH_POLL_INTERVAL_MS=1000
+WEB_PUSH_OUTBOX_POLL_MS=1000
+
 # Shared image service. The two secret files must contain the values configured
 # for the core2026 caller on the image server and must not be committed.
 IMAGE_SERVICE_URL=https://sam-image.hided.net