fix: use webpush-go's GenerateVAPIDKeys

Old implementation just copied random bytes as the public key (not real EC math).
New cmd/keygen calls the library's proper P-256 key generation.
Removed broken local GenerateVAPIDKeys from push/handlers.go.

cmd/keygen/main.go

@@ -0,0 +1,17 @@
+package main
+
+import (
+	"fmt"
+	"log"
+
+	webpush "github.com/SherClockHolmes/webpush-go"
+)
+
+func main() {
+	priv, pub, err := webpush.GenerateVAPIDKeys()
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println("VAPID_PRIVATE_KEY=" + priv)
+	fmt.Println("VAPID_PUBLIC_KEY=" + pub)
+}

internal/push/handlers.go

@@ -2,9 +2,7 @@ package push
 
 import (
 	"context"
-	"crypto/rand"
 	"database/sql"
-	"encoding/base64"
 	"encoding/json"
 	"log/slog"
 	"net/http"
@@ -256,19 +254,4 @@ func (h *Handler) SendChannelNotification(ctx context.Context, channelID, author
 	}
 }
 
-// GenerateVAPIDKeys generates a new VAPID key pair.
-func GenerateVAPIDKeys() (publicKey, privateKey string, err error) {
-	privateKeyBytes := make([]byte, 32)
-	_, err = rand.Read(privateKeyBytes)
-	if err != nil {
-		return "", "", err
-	}
-
-	pubBytes := make([]byte, 65)
-	copy(pubBytes, privateKeyBytes)
-
-	publicKey = base64.RawURLEncoding.EncodeToString(pubBytes)
-	privateKey = base64.RawURLEncoding.EncodeToString(privateKeyBytes)
-
-	return publicKey, privateKey, nil
-}
+// GenerateVAPIDKeys is in cmd/keygen. Use github.com/SherClockHolmes/webpush-go directly.