feat: update push notification subscription flow and remove deprecated opt-in component

frontend/vue-app/e2e/plans/parent-notifications.plan.md

@@ -60,11 +60,13 @@ This endpoint creates a valid `DigestActionToken` (with correct HMAC-SHA256 sign
 
 **Seed:** No child/task setup required. Tests use `page.context().grantPermissions(['notifications'])` as needed. No `afterAll` cleanup.
 
-#### 1.1. Subscription POST is sent on parent mount when permission is pre-granted
+> **Note on trigger**: Push subscription is now initiated by the Push Notifications toggle in `/parent/profile` (which calls `subscribeToPushWithResult()` directly). For these tests, triggering is done via the profile toggle rather than navigating to `/parent/tasks/chores`. PIN entry also triggers subscription in production but pre-authenticated E2E sessions bypass the PIN flow.
+
+#### 1.1. Subscription POST is sent when Push Notifications toggle is enabled and permission is pre-granted
 
 - Call `page.context().grantPermissions(['notifications'])`
 - Intercept `POST /api/push-subscription` with `page.route()` to capture request body
-- Navigate to `/parent/tasks/chores` (triggers ParentLayout mount → SW registration → subscribe → POST)
+- Navigate to `/parent/profile` and click the Push Notifications toggle to enable it
 - expect: Intercepted request body contains a non-empty `endpoint` string
 - expect: Intercepted request body contains non-empty `keys.p256dh` and `keys.auth` strings
 - expect: Intercepted request body contains a non-empty `timezone` string
@@ -72,7 +74,7 @@ This endpoint creates a valid `DigestActionToken` (with correct HMAC-SHA256 sign
 #### 1.2. Subscription POST body includes the browser's IANA timezone string
 
 - Grant notifications permission, intercept `POST /api/push-subscription`
-- Navigate to `/parent/tasks/chores`
+- Navigate to `/parent/profile` and click the Push Notifications toggle to enable it
 - Obtain browser timezone via `page.evaluate(() => Intl.DateTimeFormat().resolvedOptions().timeZone)`
 - expect: The `timezone` field in the intercepted POST body equals the value from `page.evaluate()`
 
@@ -80,7 +82,7 @@ This endpoint creates a valid `DigestActionToken` (with correct HMAC-SHA256 sign
 
 - Do NOT grant notification permission (leave default)
 - Track calls to `POST /api/push-subscription` via `page.route()`
-- Navigate to `/parent/tasks/chores`, wait for page to settle
+- Navigate to `/parent/profile` and attempt to click the Push Notifications toggle
 - expect: No POST to `/api/push-subscription` was captured
 
 #### 1.4. Backend rejects unauthenticated subscription POST (401)
@@ -590,8 +592,8 @@ This allows a spec to simulate notification action clicks without OS interaction
 
 - Call `page.context().grantPermissions(['notifications'])` before navigation
 - Intercept `POST /api/push-subscription` and respond `200 OK` (to avoid real push registration)
-- Navigate to `/parent/tasks/chores` first (triggers `ParentLayout` subscription POST)
-- Then navigate to `/parent/profile`
+- Navigate to `/parent/profile` and click the Push Notifications toggle to enable it (triggers `subscribeToPushWithResult()` POST)
+- Reload or re-navigate to `/parent/profile`
 - expect: The Push Notifications toggle is checked/on
 
 #### 10.8. Push Notifications toggle is disabled when browser permission is denied