iOS/Safari (Apple APNs) rejects the hard-coded mailto:noreply@meshcore.local VAPID subject with 403 BadJwtToken because .local is a reserved TLD; FCM accepts it, so only Apple devices were affected. Add MESHCORE_VAPID_SUBJECT (default unchanged) resolved via a new get_vapid_claims() in app/push/vapid.py, used by both dispatch and the test-notification endpoint.
Closes#288