adventure: let a player back out from the web, not only in Matrix

Three verbs to match gogobee's: call off an expedition, turn back out of
somebody else's party, send the pet sitter home. Which one this page
offers is derived here rather than pushed — leadership is already legible
in the party seats and the sitter's standing is already in the babysit
offer, so nothing new crosses the wire.

Two things running it turned up that no test would have. An applied
abandon left "Pull out of the run" sitting under a verdict saying the
expedition was over, so an applied verb now also hides the other verbs it
just made untrue. And a party member was being offered that same button
in the first place, beside the one that actually works — Pete knows from
the seat it just read that gogobee would refuse it, so it is withheld.

Also: heal the Matrix handle onto push rows stored before the column
existed, on its own endpoint rather than through the subscribe upsert,
which resets both watermarks and would have silenced the digest for
anybody who reads the site regularly. And stack the board row below sm —
four flex columns that wrapped to six lines on a phone, pre-existing.

internal/storage/push.go

@@ -45,6 +45,33 @@ func AddPushSubscription(sub, localpart, endpoint, p256dh, auth string) error {
 	return nil
 }
 
+// HealPushSubscriptionLocalpart fills in the Matrix handle on a row that was
+// stored before push_subscriptions had the column — the rows that can never match
+// an owner-scoped adventure alert, and whose owners have no way to notice.
+//
+// It is deliberately NOT AddPushSubscription with the same arguments. That upsert
+// resets both watermarks to now, which is right when somebody opts in and
+// catastrophic on a heal: the browser would call it on every page load, so a
+// reader who visits daily would silently never receive a digest or an alert
+// again. This touches one column and no clock.
+//
+// Scoped to user_sub so presenting somebody else's endpoint rewrites nothing, and
+// restricted to rows whose localpart is still empty — so it is a no-op after the
+// first success, and it can never overwrite a good handle with a stale one.
+func HealPushSubscriptionLocalpart(sub, endpoint, localpart string) error {
+	if localpart == "" {
+		return nil // nothing to heal with; see AddPushSubscription on empty handles
+	}
+	_, err := Get().Exec(
+		`UPDATE push_subscriptions SET user_localpart = ?
+		  WHERE endpoint = ? AND user_sub = ? AND user_localpart = ''`,
+		localpart, endpoint, sub)
+	if err != nil {
+		return fmt.Errorf("heal push subscription: %w", err)
+	}
+	return nil
+}
+
 // RemovePushSubscription drops one endpoint regardless of owner. Reserved for
 // the digest sender's prune path, where a push service has reported the endpoint
 // gone (404/410) and there's no caller identity to scope by. User-initiated