feat: moderator-scoped admin access + fix push notifications not displaying (v0.66.0)

Moderator role existed in the schema and was already respected by
comment deletion, but every admin page/route treated moderator
identically to a regular user (403/redirect). Wires it up narrowly:
admin/layout.tsx now lets admin+moderator through and filters the
nav by role, while every admin-only page (users, tiers, settings,
webhooks, insights, etc.) explicitly redirects moderators away via a
new requireFullAdminPage() helper -- the nav filter is UX, this is
the actual gate. Moderators land on Reports and Recipes: reports
GET/PATCH now accept requireAdmin({allowModerator: true}), and a new
PATCH /api/v1/admin/recipes/[id] lets admin+moderator unpublish a
public recipe (flip to private) as a takedown action, audit-logged.

Also found and fixed a real bug while auditing the PWA push pipeline
for a "push click-through" gap: public/sw.js had no `push` event
listener at all, so incoming push messages never displayed anything
-- push was silently non-functional end-to-end despite the
subscribe/send plumbing all working. Added the push listener
(showNotification) and a notificationclick listener that focuses an
existing tab or opens one at the payload's url.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/components/admin/unpublish-recipe-button.tsx

@@ -0,0 +1,36 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { toast } from "sonner";
+import { Button } from "@/components/ui/button";
+
+export function UnpublishRecipeButton({ recipeId }: { recipeId: string }) {
+  const router = useRouter();
+  const [busy, setBusy] = useState(false);
+
+  async function unpublish() {
+    if (!confirm("Unpublish this recipe? It becomes private — only the author can see it.")) return;
+    setBusy(true);
+    try {
+      const res = await fetch(`/api/v1/admin/recipes/${recipeId}`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ action: "unpublish" }),
+      });
+      if (!res.ok) throw new Error();
+      toast.success("Recipe unpublished");
+      router.refresh();
+    } catch {
+      toast.error("Failed to unpublish");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <Button type="button" variant="outline" size="sm" className="h-6 px-2 text-xs" disabled={busy} onClick={() => { void unpublish(); }}>
+      {busy ? "Unpublishing…" : "Unpublish"}
+    </Button>
+  );
+}