fix: iOS push notification prompt

iOS requires user gesture for Notification.requestPermission().
- Added NotificationPrompt banner that shows on permission='default'
- autoSubscribePush only fires when already 'granted' (re-subscribe on restore)
- Banner uses tap handler for permission request (works on iOS)
- Gruvbox themed, dismissible, bottom-center toast

web/src/stores/auth.ts

@@ -72,10 +72,12 @@ interface AuthState {
 }
 
 // ponytail: auto-subscribe to push notifications on auth
+// Only fires when permission is already 'granted' (re-subscribe on session restore).
+// iOS requires a user gesture for the initial permission prompt — that's handled by NotificationPrompt.
 function autoSubscribePush() {
   import("../stores/push.ts").then(({ usePushStore }) => {
     const ps = usePushStore.getState();
-    if (ps.isSupported && Notification.permission !== 'denied' && !ps.isSubscribed) {
+    if (ps.isSupported && Notification.permission === 'granted' && !ps.isSubscribed) {
       ps.subscribe();
     }
   });