support PWA notification.

API/ROLAC.API/Data/AppDbContext.cs

@@ -38,6 +38,7 @@ public class AppDbContext : IdentityDbContext<AppUser, AppRole, string>
     public DbSet<LineBindingCode>      LineBindingCodes      => Set<LineBindingCode>();
     public DbSet<MessagingGroup>       MessagingGroups       => Set<MessagingGroup>();
     public DbSet<NotificationLog>      NotificationLogs      => Set<NotificationLog>();
+    public DbSet<WebPushSubscription>  WebPushSubscriptions  => Set<WebPushSubscription>();
 
     public DbSet<SiteSetting>          SiteSettings          => Set<SiteSetting>();
     public DbSet<NotificationSetting>  NotificationSettings  => Set<NotificationSetting>();
@@ -560,6 +561,18 @@ public class AppDbContext : IdentityDbContext<AppUser, AppRole, string>
                   .HasForeignKey(e => e.MessagingGroupId).OnDelete(DeleteBehavior.SetNull);
         });
 
+        builder.Entity<WebPushSubscription>(entity =>
+        {
+            entity.Property(e => e.Endpoint).HasMaxLength(2000).IsRequired();
+            entity.Property(e => e.P256dh).HasMaxLength(200).IsRequired();
+            entity.Property(e => e.Auth).HasMaxLength(100).IsRequired();
+            entity.Property(e => e.UserAgent).HasMaxLength(400);
+            entity.HasIndex(e => e.Endpoint).IsUnique();
+            entity.HasIndex(e => e.MemberId);
+            entity.HasOne(e => e.Member).WithMany()
+                  .HasForeignKey(e => e.MemberId).OnDelete(DeleteBehavior.Cascade);
+        });
+
         // ── SystemLog / AuditLog (append-only) ───────────────────────────────
         // Mapped here for SCHEMA only — there are deliberately no DbSets on this
         // context, so business code can't write logs through the audited context.

API/ROLAC.API/Data/DbSeeder.cs

@@ -474,6 +474,20 @@ public static class DbSeeder
             });
             await db.SaveChangesAsync();
         }
+
+        // Generate the VAPID key pair once so Web Push works out of the box. Persisted on the
+        // singleton row; the public key is handed to browsers, the private key signs each push.
+        var row = await db.NotificationSettings.OrderBy(s => s.Id).FirstAsync();
+        if (string.IsNullOrWhiteSpace(row.VapidPublicKey))
+        {
+            var keys = WebPush.VapidHelper.GenerateVapidKeys();
+            row.VapidPublicKey  = keys.PublicKey;
+            row.VapidPrivateKey = keys.PrivateKey;
+            if (string.IsNullOrWhiteSpace(row.VapidSubject))
+                row.VapidSubject = "mailto:admin@rolac.local";
+            row.EnableWebPush = true;
+            await db.SaveChangesAsync();
+        }
     }
 
     /// <summary>