Add personal notes, DeepSearch history, backup offload, and gateway auth throttling

Also streamline the top navigation: drop the Tools dropdown, make Quizzes
and Battles icon-only entries, and remove the Workspace, Containers and
Editor entry points from the project detail page.

tests/api/pushjson.py

@@ -121,6 +121,87 @@ def test_register_non_object_body_rejected(app_server):
     assert r.status_code == 400
 
 
+def test_unregister_requires_auth(app_server):
+    r = requests.delete(
+        f"{BASE_URL}/push.json",
+        json={"endpoint": "https://push.example.com/anon"},
+        allow_redirects=False,
+    )
+    assert r.status_code == 401
+
+
+def test_unregister_invalid_json_rejected(app_server):
+    s = _session_push()
+    r = s.delete(
+        f"{BASE_URL}/push.json",
+        data="not-json",
+        headers={"Content-Type": "application/json"},
+    )
+    assert r.status_code == 400
+
+
+def test_unregister_non_object_body_rejected(app_server):
+    s = _session_push()
+    r = s.delete(f"{BASE_URL}/push.json", json=["nope"])
+    assert r.status_code == 400
+
+
+def test_unregister_unknown_provider_rejected(app_server):
+    s = _session_push()
+    r = s.delete(
+        f"{BASE_URL}/push.json",
+        json={"provider": "carrier-pigeon", "endpoint": "https://push.example.com/x"},
+    )
+    assert r.status_code == 400
+
+
+def test_unregister_missing_identity_rejected(app_server):
+    s = _session_push()
+    r = s.delete(f"{BASE_URL}/push.json", json={})
+    assert r.status_code == 400
+
+
+def test_unregister_unknown_identity_is_idempotent(app_server):
+    s = _session_push()
+    r = s.delete(
+        f"{BASE_URL}/push.json",
+        json={"endpoint": "https://push.example.com/never-registered"},
+    )
+    assert r.status_code == 200, r.text
+    assert r.json().get("unregistered") is False
+
+
+def test_unregister_removes_a_registered_subscription(app_server):
+    s = _session_push()
+    body = {
+        "endpoint": "https://push.example.com/to-unregister",
+        "keys": {"p256dh": "p256dh_fake", "auth": "auth_fake"},
+    }
+    assert s.post(f"{BASE_URL}/push.json", json=body).status_code == 200
+
+    r = s.delete(f"{BASE_URL}/push.json", json={"endpoint": body["endpoint"]})
+    assert r.status_code == 200, r.text
+    assert r.json().get("unregistered") is True
+
+    r = s.delete(f"{BASE_URL}/push.json", json={"endpoint": body["endpoint"]})
+    assert r.status_code == 200, r.text
+    assert r.json().get("unregistered") is False
+
+
+def test_unregister_then_register_revives_the_row(app_server):
+    s = _session_push()
+    body = {
+        "endpoint": "https://push.example.com/revive-after-unregister",
+        "keys": {"p256dh": "p256dh_fake", "auth": "auth_fake"},
+    }
+    assert s.post(f"{BASE_URL}/push.json", json=body).status_code == 200
+    assert s.delete(f"{BASE_URL}/push.json", json={"endpoint": body["endpoint"]}).status_code == 200
+
+    r = s.post(f"{BASE_URL}/push.json", json=body)
+    assert r.status_code == 200, r.text
+    assert r.json().get("registered") is True
+
+
 def test_register_ignores_client_id_on_webpush(app_server):
     s = _session_push()
     r = s.post(