feat(agent): add opt-in push notifications

web/src/hooks/use-session-auth.ts

@@ -1,5 +1,6 @@
 import { useEffect, useState } from "preact/hooks";
 import { getConfiguredToken, setAuthToken, verifySession } from "@/lib/api";
+import { revokeAgentBrowserPush, startAgentBrowserSession } from "@/lib/agent-push-browser";
 
 const TOKEN_STORAGE_KEY = "sybil_admin_token";
 
@@ -47,6 +48,7 @@ export function useSessionAuth() {
   };
 
   const handleAuthFailure = (message: string | null) => {
+    void revokeAgentBrowserPush();
     setIsAuthenticated(false);
     setAuthMode(null);
     setAuthError(message ? normalizeAuthError(message) : null);
@@ -69,7 +71,8 @@ export function useSessionAuth() {
     }
   };
 
-  const logout = () => {
+  const logout = async () => {
+    await revokeAgentBrowserPush();
     setAuthToken(null);
     persistToken(null);
     setIsAuthenticated(false);
@@ -77,6 +80,18 @@ export function useSessionAuth() {
     setAuthError(null);
   };
 
+  useEffect(() => {
+    if (!isAuthenticated || authMode !== "token") return;
+    return startAgentBrowserSession();
+  }, [isAuthenticated, authMode]);
+
+  useEffect(() => {
+    // Signing out in one tab retires the others instead of using a stale token.
+    const signedOut = (event: StorageEvent) => { if (event.key === TOKEN_STORAGE_KEY && !event.newValue) handleAuthFailure(null); };
+    window.addEventListener("storage", signedOut);
+    return () => window.removeEventListener("storage", signedOut);
+  }, []);
+
   useEffect(() => {
     const token = readStoredToken() ?? getConfiguredToken();
     void (async () => {