fix: ui fixes

lib/push.ts

@@ -110,10 +110,23 @@ export async function enablePush(): Promise<void> {
     throw new Error("Notification permission was not granted.");
   }
 
-  const reg = await navigator.serviceWorker.register("/sw.js");
+  // The BFF origin rides along as a query param so the service worker can
+  // re-register rotated subscriptions (pushsubscriptionchange) on its own.
+  const reg = await navigator.serviceWorker.register(
+    `/sw.js?bff=${encodeURIComponent(BFF_BASE)}`,
+  );
   await navigator.serviceWorker.ready;
 
   let sub = await reg.pushManager.getSubscription();
+  // A subscription minted under a previous VAPID key still looks alive
+  // locally, but every send fails with a credential mismatch — drop it and
+  // subscribe fresh under the current key.
+  if (sub && !matchesServerKey(sub, public_key)) {
+    await sub.unsubscribe().catch(() => {
+      /* stale anyway — subscribe() below replaces it */
+    });
+    sub = null;
+  }
   if (!sub) {
     sub = await reg.pushManager.subscribe({
       userVisibleOnly: true,
@@ -134,6 +147,19 @@ export async function enablePush(): Promise<void> {
   if (!res.ok) throw new Error("Could not save your subscription.");
 }
 
+/**
+ * Whether an existing subscription was created with the server's current
+ * VAPID public key. Browsers that don't expose applicationServerKey (older
+ * Safari) return null — treat that as a match rather than churn the sub.
+ */
+function matchesServerKey(sub: PushSubscription, publicKey: string): boolean {
+  const current = sub.options?.applicationServerKey;
+  if (!current) return true;
+  const a = new Uint8Array(current);
+  const b = urlBase64ToUint8Array(publicKey);
+  return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+
 /** Disable push: unsubscribe locally and remove the subscription server-side. */
 export async function disablePush(): Promise<void> {
   const reg = await registration();