Push reminders: personal to the notes, generic without them

The daily reminder said one generic line to everyone, because the server
never sees a deck. Now the notification text is written in the browser
(lib/reminder.ts) and travels with the subscription:

- Personal: "3 cards are due in Sky deck", in the app's language, tapping
  through to /review. Without notes (or with nothing due) it is the plain
  nudge, translated in both languages — push.title / push.due.* / push.generic.
- POST /api/push accepts an optional message {title, body, url}; url must be
  a path on this app, so a stolen subscription cannot make the notification
  link elsewhere. The store keeps endpoint, keys, the message and createdAt
  (a refresh no longer resets the timestamp).
- components/PushReminderSync.tsx refreshes the stored text when the app
  opens and whenever the tab becomes visible (throttled to twice a day), so a
  count is only ever sent while it is true.
- scripts/send-reminders.mjs sends each device its own text and falls back to
  PUSH_REMINDER_TITLE/_BODY for a subscription that has none
  (scripts/reminder-payload.mjs, unit-checked).
- /api/push/test previews the real reminder with a "Test:" prefix.
- deploy/freezmo-reminders.{service,timer}: the daily send as a systemd user
  timer (18:00 local, Persistent, randomised), documented in the README.
- Settings copy, privacy page (en+cs) and .env.example say exactly what the
  server now holds.
- phase2-test grew the whole path with a faked browser subscription: personal
  text in en and cs, the generic fallback in both, the URL guard, and the
  sender's preference order (81 checks).

Version 0.8.2, SW v104.

scripts/reminder-payload.mjs

@@ -0,0 +1,36 @@
+/**
+ * What one stored subscription's reminder should say.
+ *
+ * Since reminders became personal (lib/reminder.ts), each subscription carries
+ * the notification text its own browser composed — already in the user's
+ * language, naming their deck when their notes could carry it. Older records
+ * (or a browser that never refreshed) have none, so the operator's generic
+ * default from the environment is the fallback. Kept in its own module so both
+ * the sender and the test suite can exercise it without sending anything.
+ */
+
+/** The operator's fallback, from PUSH_REMINDER_* (see .env.example). */
+export const DEFAULT_REMINDER = {
+  title: "Time to review",
+  body: "Your decks are waiting — a few due cards keep the streak alive.",
+  url: "/",
+};
+
+function text(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+export function reminderPayload(entry, defaults = DEFAULT_REMINDER) {
+  const fallback = {
+    title: text(defaults?.title) || DEFAULT_REMINDER.title,
+    body: text(defaults?.body) || DEFAULT_REMINDER.body,
+    url: text(defaults?.url) || DEFAULT_REMINDER.url,
+  };
+  const message = entry?.message;
+  if (!message || typeof message !== "object") return fallback;
+  const title = text(message.title);
+  const body = text(message.body);
+  if (!title || !body) return fallback;
+  const url = text(message.url);
+  return { title, body, url: url.startsWith("/") ? url : fallback.url };
+}