feat: graduate web-push from experiment to always-on (#24310)

* Removes experiment `web-push`.
* Falls back to NoopWebpusher in case of error
* Checks browser capability in FE
* Adds note to agents getting-started docs regarding webpush without TLS

> 🤖

docs/ai-coder/agents/getting-started.md

@@ -159,6 +159,18 @@ dedicated test or staging deployment to avoid disruption to production
 developer workflows. See [Early Access](./early-access.md) for the full
 set of expectations and limitations.
 
+### Use HTTPS for push notifications
+
+Coder Agents use browser push notifications to alert you when a task
+completes or needs attention. Most browsers require a secure (HTTPS)
+origin for the [Push API](https://developer.mozilla.org/en-US/docs/Web/API/Push_API)
+to work. If your access URL uses plain HTTP,
+push notifications may not function.
+
+This does not affect agents themselves — only the browser notification
+delivery. If you terminate TLS at a reverse proxy, ensure the
+[access URL](../../admin/setup/index.md) is configured with an `https://` scheme.
+
 ### Set a deployment-wide system prompt
 
 Administrators can set a system prompt that applies to all Coder Agents across the