Build staff push-notification console in pycon-site

[JacobCoffee]

Goal

Replace Firebase Console / curl as the way staff send push notifications. Build a Django page in pycon-site that authorized staff can use to send pushes to FCM topics that the mobile app already subscribes to.

Context

The mobile app already wires up FCM topic subscribe/unsubscribe based on user-controlled toggles:

• announcements — general updates ("keynote starting now," "opening reception in 20 min")
• schedule-changes — talk moved/rescheduled/cancelled
• emergency — ICE / safety / evacuation

Currently the only ways to fire a push are Firebase Console UI (limited access) or curl (Jacob-only). Staff need a way to do this themselves without dev involvement.

Spec

Detailed implementation plan (model, view, form, template, services, settings, tests, runbook) is in:

~/git/internal/pycon/pycon-site/.claude/PLAN-PUSH-NOTIFICATIONS.md

The plan is fully self-contained — another agent or engineer with no prior context can implement it.

Acceptance

See "Acceptance criteria" section in the plan. Highlights:

• Staff-only Django page at /2026/admin/notifications/
• Topic dropdown, title, body, "type EMERGENCY to confirm" gate for emergency
• Audit log model — every send (success or failure) recorded with who/when/what
• Permissions: notifications.add_pushnotification for the page, separate notifications.send_emergency for emergency sends
• Service-account credential held server-side, sourced from env var
• Tests covering auth, perm gating, success persistence, failure persistence

Out of scope (file separately if needed)

• Per-user-segment targeting beyond topic broadcasts
• Scheduled / future-dated sends
• Rich payloads (images, deep-links into specific schedule sessions)
• Auto-pushes triggered by CMS edits (e.g. publishing a schedule change auto-sends)

Pre-deploy checklist for ops

• Generate Firebase service-account key for project pycon-us-2023-mobile
• Grant roles/firebasecloudmessaging.admin to that service account
• Place key on server outside repo, set FCM_SERVICE_ACCOUNT_KEY_PATH env var
• Create Django group Push Notifiers, add trusted staff
• Optionally create separate Emergency Notifiers group with the send_emergency permission

[linear-code]

PYMOBIL-123