feat: graduate web-push from experiment to always-on (#24310)

* Removes experiment `web-push`.
* Falls back to NoopWebpusher in case of error
* Checks browser capability in FE
* Adds note to agents getting-started docs regarding webpush without TLS

> 🤖

coderd/webpush/webpush.go

@@ -386,9 +386,11 @@ func (n *Webpusher) PublicKey() string {
 	return n.VAPIDPublicKey
 }
 
-// NoopWebpusher is a Dispatcher that does nothing except return an error.
-// This is returned when web push notifications are disabled, or if there was an
-// error generating the VAPID keys.
+// NoopWebpusher is a Dispatcher that always fails, returning Msg as
+// the error. It is used as a fallback when VAPID key setup fails.
+// The underlying error is not included to avoid leaking internal
+// details (e.g. database errors) in API responses; it is logged at
+// the call site instead.
 type NoopWebpusher struct {
 	Msg string
 }

coderd/webpush/webpush_test.go

@@ -405,3 +405,21 @@ func setupPushTestWithOptions(ctx context.Context, t *testing.T, db database.Sto
 
 	return manager, db, server.URL
 }
+
+func TestNoopWebpusher(t *testing.T) {
+	t.Parallel()
+
+	noop := &webpush.NoopWebpusher{
+		Msg: "push disabled",
+	}
+
+	dispatchErr := noop.Dispatch(context.Background(), uuid.New(), codersdk.WebpushMessage{})
+	require.Error(t, dispatchErr)
+	require.Contains(t, dispatchErr.Error(), "push disabled")
+
+	testErr := noop.Test(context.Background(), codersdk.WebpushSubscription{})
+	require.Error(t, testErr)
+	require.Contains(t, testErr.Error(), "push disabled")
+
+	require.Empty(t, noop.PublicKey())
+}