fix(notifications): drop the unreachable WEB_PUSH_* VAPID aliases

Six WEB_PUSH_* names and NEXT_PUBLIC_VAPID_PUBLIC_KEY sat behind the three
real VAPID_* variables in the env fallback. None was ever on the compose
environment: whitelist and none appeared in .env.example, .env.production.example
or the env manifest, so under the bundled stack a value set under any of them
could not reach the process. Remove them and the self-hosting note that
advertised them.

docs/self-hosting/notifications.md

@@ -91,10 +91,8 @@ VAPID_PRIVATE_KEY="...(private key)"
 VAPID_SUBJECT="mailto:you@example.com"
 ```
 
-The database values win when both are present. The loader also accepts a
-few aliases (`WEB_PUSH_VAPID_PUBLIC_KEY`, `WEB_PUSH_PUBLIC_KEY`, and the
-private/subject equivalents) so a config copied from another deployment
-keeps working.
+The database values win when both are present. These three names are the
+only ones the loader reads.
 
 ### 3. Subscribe a device
 

src/lib/notifications/vapid-config.ts

@@ -8,20 +8,21 @@ export interface VapidConfig {
   subject: string;
 }
 
+/**
+ * The env fallback, read when the admin Settings panel has no key pair stored.
+ *
+ * `VAPID_PUBLIC_KEY` / `VAPID_PRIVATE_KEY` / `VAPID_SUBJECT` are the only
+ * names. Six `WEB_PUSH_*` aliases and a `NEXT_PUBLIC_VAPID_PUBLIC_KEY` one
+ * used to sit behind them; none was ever on the compose `environment:`
+ * whitelist, so under the bundled stack a value set under any of those names
+ * could not reach this process, and none appeared in `.env.example`,
+ * `.env.production.example` or the env manifest. They read as an escape hatch
+ * that had never been open.
+ */
 function fromEnv(): VapidConfig | null {
-  const publicKey =
-    process.env.VAPID_PUBLIC_KEY ??
-    process.env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ??
-    process.env.WEB_PUSH_VAPID_PUBLIC_KEY ??
-    process.env.WEB_PUSH_PUBLIC_KEY;
-  const privateKey =
-    process.env.VAPID_PRIVATE_KEY ??
-    process.env.WEB_PUSH_VAPID_PRIVATE_KEY ??
-    process.env.WEB_PUSH_PRIVATE_KEY;
-  const subject =
-    process.env.VAPID_SUBJECT ??
-    process.env.WEB_PUSH_VAPID_SUBJECT ??
-    process.env.WEB_PUSH_SUBJECT;
+  const publicKey = process.env.VAPID_PUBLIC_KEY;
+  const privateKey = process.env.VAPID_PRIVATE_KEY;
+  const subject = process.env.VAPID_SUBJECT;
 
   if (!publicKey || !privateKey || !subject) return null;
   return { publicKey, privateKey, subject };