feat: overhaul with modular API, agent endpoints, migrations, backup and tests

- Split monolithic app.py into server/api/ routers
- Add Pydantic schemas for input validation
- Add /agent/* API with separate AGENT_TOKEN auth
- Replace static schema.sql with versioned migrations (datenerhaltend)
- Add tools/backup_db.py for SQLite backups
- Add Dockerfile HEALTHCHECK and compose.yml AGENT_TOKEN env
- Add pytest tests for user and agent API
- Update README with API docs and deployment safety notes
- Bump version to 1.2.0

server/api/push.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import JSONResponse
+
+from server.auth import require_auth
+from server.db import get_db
+from server.push import save_subscription
+from server.schemas import PushSubscribe
+
+router = APIRouter(prefix="/api/push", tags=["push"])
+
+NO_STORE = {"Cache-Control": "no-store"}
+
+
+@router.get("/vapid-public-key")
+async def vapid_public_key() -> JSONResponse:
+    from server.settings import settings
+
+    return JSONResponse({"key": settings.vapid_public_key}, headers=NO_STORE)
+
+
+@router.post("/subscribe")
+async def push_subscribe(payload: PushSubscribe, _: dict = Depends(require_auth)) -> JSONResponse:
+    if not payload.subscription or not payload.subscription.get("endpoint"):
+        raise HTTPException(status_code=400, detail="Invalid subscription")
+    db = await get_db()
+    try:
+        await save_subscription(db, payload.subscription)
+    finally:
+        await db.close()
+    return JSONResponse({"ok": True}, headers=NO_STORE)