fix: use webpush-go's GenerateVAPIDKeys

Old implementation just copied random bytes as the public key (not real EC math).
New cmd/keygen calls the library's proper P-256 key generation.
Removed broken local GenerateVAPIDKeys from push/handlers.go.

internal/push/handlers.go

@@ -2,9 +2,7 @@ package push
 
 import (
 	"context"
-	"crypto/rand"
 	"database/sql"
-	"encoding/base64"
 	"encoding/json"
 	"log/slog"
 	"net/http"
@@ -256,19 +254,4 @@ func (h *Handler) SendChannelNotification(ctx context.Context, channelID, author
 	}
 }
 
-// GenerateVAPIDKeys generates a new VAPID key pair.
-func GenerateVAPIDKeys() (publicKey, privateKey string, err error) {
-	privateKeyBytes := make([]byte, 32)
-	_, err = rand.Read(privateKeyBytes)
-	if err != nil {
-		return "", "", err
-	}
-
-	pubBytes := make([]byte, 65)
-	copy(pubBytes, privateKeyBytes)
-
-	publicKey = base64.RawURLEncoding.EncodeToString(pubBytes)
-	privateKey = base64.RawURLEncoding.EncodeToString(privateKeyBytes)
-
-	return publicKey, privateKey, nil
-}
+// GenerateVAPIDKeys is in cmd/keygen. Use github.com/SherClockHolmes/webpush-go directly.