chore(deploy): enable Web Push with a fresh VAPID identity

[push] is now on for production: a new P-256 key pair (public key 65-byte
uncompressed, private 32-byte scalar, both base64url without padding) and
subject mailto:bot@mail.gitdata.ai, matching the transactional sender.

Only the public half lives in this file. config.env renders as container
env:, which wins over the envFrom: Secret for same-named keys, so
APP_PUSH__VAPID_PRIVATE_KEY is supplied exclusively through
PROD_SECRET_VALUES - an empty placeholder here would shadow the real key
and every VAPID JWT would be signed with an unusable identity.

apihost validates the pair with real curve math at startup
(push::client::VapidKeys::from_config) and exits rather than signing
junk, so the pair was generated and verified together with openssl before
being split across the two files; the PEM and both halves are backed up
under the operator's k8s-backups directory.