Pin github.com/SherClockHolmes/webpush-go v1.4.0 (MIT, jwt/v5 share, Options.HTTPClient = *fetchguard.Client Do). The in-tree flare module is the rejected alternative (push.* keys, websockets:generate-vapid-keys). Co-authored-by: Cursor <cursoragent@cursor.com>