Docs: complete sample config, fix README config reference

- Add screenshots to README "What is OOTT?" section
- Document the "push" notification method and notifications.push.relay_url
- Fix misleading retention duration example (m = minutes, not months)
- Add web_server.api_key to the Nix service example
- Make sample_oott.toml a complete, functional baseline: every option
  present, mutually-exclusive notification provider sections commented out
- Trim completed items from TODO.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -27,6 +27,12 @@ OOTT runs behind the scenes and monitors your local network, notifying you when
 
 You configure and browse the data it collects through a companion app available on the web, desktop, iOS and Android.
 
+<p align="center">
+  <img src="examples/screenshots/desktop_home.png" alt="OOTT on the web" width="70%">
+  <br>
+  <img src="examples/screenshots/ios_devices.png" alt="OOTT on mobile" width="25%">
+</p>
+
 ## Getting started
 
 ### Simple installation with Docker
@@ -144,6 +150,7 @@ modules = [
   services.oott = {
     enable = true;
     database.path = "/var/lib/oott.db";
+    web_server.api_key = "CHANGE_ME"; # API key the app uses to talk to the backend — change this!
     # networking.interface = "eth0"; # Optional: auto-detected if not set
     log.level = "warn";
     arp_scanner.wait_between_scans = "30m";
@@ -186,11 +193,12 @@ Options marked **Required** have no built-in default and must be set in your con
 |`snmp_scanner.community`|**Required**|SNMPv2c read-only community string. Use a read-only community and never commit a real secret. Required when the `[snmp_scanner]` section is present.|
 |`snmp_scanner.wait_between_scans`|`10m`|Time to wait between polls. Keep it well under the agent's ARP cache timeout so active devices aren't missed.|
 |`snmp_scanner.timeout`|`5s`|Per-poll SNMP request timeout.|
-|`notifications.method`|**Required**|For now just pushover, you can set this to "none" to avoid sending notifications (it will just log)|
+|`notifications.method`|**Required**|How notifications are delivered. One of: `pushover` (send via [Pushover](https://pushover.net/)), `push` (native push to the OOTT mobile apps through the project-operated relay), or `none` (don't send, just log).|
 |`notifications.notify_when_not_seen_for`|`1w`|Send a notification if a device comes back online after not being seen for this timeframe (you can use hours, weeks, etc.)|
 |`notifications.pushover.token`|**Required when `method` is `pushover`**|Your pushover token goes here, just copy&paste from their website after creating the app. The whole `[notifications.pushover]` section may be omitted when `method` is anything other than `pushover`|
 |`notifications.pushover.user_key`|**Required when `method` is `pushover`**|User key goes here, this is the account wide code for pushover. The whole `[notifications.pushover]` section may be omitted when `method` is anything other than `pushover`|
-|`retention.window`|`365d`|How long to retain device events and notifications. Records older than this are purged daily. Accepts duration strings (e.g. `90d`, `1y`, `6m`).|
+|`notifications.push.relay_url`|project relay (built-in)|Endpoint of the push relay used when `method` is `push`. The whole `[notifications.push]` section is optional: with `method = "push"` and no section, the built-in project-operated relay is used — you need set nothing. Override this only if you run your own relay.|
+|`retention.window`|`365d`|How long to retain device events and notifications. Records older than this are purged daily. Accepts duration strings — `d` days, `w` weeks, `h` hours, `m` minutes (e.g. `90d`, `2w`, `1y`).|
 |`device_events.deduplication_window`|`1m`|Suppress duplicate device events: if the same scanner sees the same device (same MAC and IPv4) again within this window, only one event is recorded. Accepts duration strings (e.g. `30s`, `1m`, `5m`).|
 
 ### Using HTTPS and domain names with the mobile apps

TODO.md

@@ -1,10 +1,5 @@
 # OOTT ToDo list
 
-- [x] Add support for push notifications to the app (iOS and Android)
-- [x] Remove push notifications plan
-- [x] Add the capability to delete a device from the system
-- [x] Review CLAUDE.md to make it shorter and easier to read for AIs while keeping all its intentions
-
 ## Release plan for 0.2.0
 - [x] Test Android UI on emulator
 - [x] Release 0.1.0
@@ -26,26 +21,14 @@
 ## Backend
 
 - [ ] Implement the pushover API call directly to support HTML content and review notification text to use it
-- [x] Check for potential dependency upgrades
 - [ ] Upgrade dependencies to new major versions
 
 ## Frontend
 
-- [x] Add a note on the settings dialog when empty that you need a backend
-- [x] On iOS, the buttons in the Settings configure dialog appear on two lines, try to fit them in one
-- [x] Add more themes (Dracula, Nord, Catppuccin Latte, Gruvbox light)
-- [x] Remove the license and notice from the UI, just link to the github pages
-- [x] On Android, make the font of the icon (phone screen) bigger
-- [x] In the status screen, the "listening for" property of passive scanners should change to days and months (now its always minutes)
 - [ ] Upgrade dependencies to new major versions
-- [x] Check for potential dependency upgrades
-- [x] In the frontend, in the settings screen, move the backend configuration to a popup dialog that asks for the URL and API key and allows the user to test and save it. In the main screen it should present both items as read only and allow the user to change the theme and push notifications and both should trigger the change immediately (ie. without a save button). The dialog for the backend config should be accesible via a "Re-configure" link or button (do what aligns best with M3). The first time the user uses the UI (or when the backend is not configured at all, it should navigate to the settings screen with the dialog open, and upon Saving the backend config it should refresh the settings page)
-- [x] The permissions dialog for push notifications on android says "Allow frontend to send you notifications"
 
 ## Push relay
 
-- [x] Add NPM to the devShell to be able to run tests
-
 ## Improve engine
 
 Passive (low noise, no probing):

examples/sample_oott.toml

@@ -36,14 +36,20 @@ enabled=true # Set to false to disable the DHCP scanner
 # UDP/161 from the host running OOTT.
 
 [notifications]
-method="pushover" # For now just pushover, you can set this to "none" to avoid sending notifications (it will just log)
+# Pick ONE delivery method below, then uncomment the matching section if it needs configuration.
+# The provider sections are mutually exclusive: enable only the one that goes with your method.
+method="none" # One of: "pushover" (send via Pushover), "push" (native push to the OOTT mobile apps via the project relay), or "none" (don't send, just log)
 notify_when_not_seen_for="1w" # Send a notification if a device comes back online after not being seen for this timeframe. Defaults to "1w" if omitted
 
-# The [notifications.pushover] section is only required when method="pushover". For any other
-# method (e.g. "none") you can omit this whole section.
-[notifications.pushover]
-token="" # Your pushover token goes here, just copy&paste from their website after creating the app
-user_key="" # User key goes here, this is the account wide code for pushover
+# Required when method="pushover" (and only then) — uncomment this section and set method="pushover" above.
+# [notifications.pushover]
+# token="" # Your pushover token goes here, just copy&paste from their website after creating the app
+# user_key="" # User key goes here, this is the account wide code for pushover
+
+# Only used when method="push", and even then optional: with no section the built-in
+# project-operated relay is used, so you usually need set nothing. Uncomment only to run your own relay.
+# [notifications.push]
+# relay_url="https://relay-dzhbmmulaq-uc.a.run.app/v1/push" # Override only if you run your own push relay.
 
 [web_server]
 ip_address="0.0.0.0" # IP to bind the web server for the API and web UI to, use 0.0.0.0 to bind it to all interfaces. Defaults to "0.0.0.0" if omitted