Feat: Push-Notifications vollständig implementiert

- push.py: /vapid-key, /subscribe, /unsubscribe + send_push_to_user/all Helpers
- VAPID Keys in docker-compose.yml (Public + Private)
- Giftköder-Meldung löst automatisch Push an alle Subscriber aus
- ON CONFLICT(endpoint) für idempotentes Re-Subscribe
- Abgelaufene Subscriptions werden bei HTTP 410 auto-gelöscht

backend/routes/poison.py

@@ -7,6 +7,7 @@ from pydantic import BaseModel
 from typing import Optional
 from database import db
 from auth import get_current_user
+from routes.push import send_push_to_all
 
 router    = APIRouter()
 MEDIA_DIR = os.getenv("MEDIA_DIR", "/data/media")
@@ -84,7 +85,17 @@ async def report_poison(data: PoisonCreate, user=Depends(get_current_user)):
             "SELECT * FROM poison WHERE user_id=? ORDER BY id DESC LIMIT 1",
             (user["id"],)
         ).fetchone()
-    return dict(row)
+    entry = dict(row)
+
+    # Push-Notification an alle User
+    send_push_to_all({
+        "type":  "poison_alert",
+        "title": "⚠️ Giftköder gemeldet!",
+        "body":  f"{data.typ or 'Verdächtiger Fund'} in deiner Nähe — bitte vorsichtig sein.",
+        "data":  {"page": "poison", "id": entry["id"]},
+    })
+
+    return entry
 
 
 # ------------------------------------------------------------------