Harden Web Push configuration and subscription handling

[iMattPro]

Hardens Web Push configuration, subscription storage, and notification delivery against malformed or unexpected input.

• Restrict ACP writes to known Web Push configuration keys.
• Reject scalar and otherwise invalid subscription JSON cleanly.
• Validate subscription key encoding, lengths, and public-key structure before storage.
• Prevent malformed stored subscriptions from interrupting remaining notification deliveries.
• Require HTTPS and standard ports for remote push-service endpoints without restricting localhost board installations.
• Allow legacy endpoint records to remain removable through unsubscribe.
• Move popup markup from document <head> into body output.
• Localize unsubscribe failure messaging.
• Handle pages without notification dropdown markup safely.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 97.42489% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.22%. Comparing base (6c9bd34) to head (348359e).

Files with missing lines	Patch %	Lines
controller/acp_controller.php	97.02%	5 Missing ⚠️
notification/method/webpush.php	96.15%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #147      +/-   ##
============================================
- Coverage     98.48%   98.22%   -0.26%     
- Complexity      249      276      +27     
============================================
  Files             9       11       +2     
  Lines           727      790      +63     
============================================
+ Hits            716      776      +60     
- Misses           11       14       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rxu]

Also (probably unrelated to this PR though), "Notification reminder pop-ups" button works regardless of web push notifications are enabled or not, so you can enable reminder anyway. If webpush notifications got disabled, it seems that reminder button makes no sense.