const ALLOWED_PUSH_ENDPOINT_PREFIXES: &[&str];
Allowed push endpoint URL prefixes. Rejects anything that isn’t a known browser push service to prevent SSRF.