Windows/IIS: add an install guide, and detect the OPENSSL_CONF failure in push-admin

[ejosterberg]

Two follow-ups split out of #5 so that issue can close when @rjonesbsink's PR merges, rather than staying open on documentation work.

1. There is no Windows/IIS install guide

README.md and docs/INSTALL.md are Debian/Apache-only. Everything a Windows/IIS administrator needs is currently spread across issue comments. A guide should cover at minimum:

OPENSSL_CONF — required before Web Push key generation will work. The Windows PHP distribution never creates C:\Program Files\Common Files\SSL\openssl.cnf, which is OpenSSL's compiled-in default config path, so openssl_pkey_new(['curve_name' => 'prime256v1', ...]) returns false and VAPID keypair generation fails with Unable to create the key. PHP ships its own copy at <PHP_DIR>\extras\ssl\openssl.cnf; it just is not wired up.

It must be set in two places, and the second is the one people miss:

# CLI (tools/generate_vapid_keys.php, tools/push_diagnose.php)
setx OPENSSL_CONF "C:\PHP84\extras\ssl\openssl.cnf" /M

# IIS — FastCGI defines its OWN environmentVariables collection per PHP
# handler, and that collection REPLACES the inherited environment rather
# than merging with it. Without this, the web UI keeps failing even after
# a full W3SVC restart.
& "$env:windir\system32\inetsrv\appcmd.exe" set config -section:system.webServer/fastCgi `
  "/+[fullPath='C:\PHP84\php-cgi.exe'].environmentVariables.[name='OPENSSL_CONF',value='C:\PHP84\extras\ssl\openssl.cnf']" `
  /commit:apphost

Then recycle the app pool.

disable_functions. disable_functions = shell_exec, exec, system, passthru, popen is a common hardening default on IIS. PHP's @ operator does not suppress the fatal "Call to undefined function" this produces, so with display_errors off (the documented production posture) the failure mode is an empty response body and a client-side Unexpected end of JSON input. Being fixed in #5; the guide should still say what to expect.

MySQL 8.0 vs MariaDB. The README lists both as supported, and they differ in ways that matter — see #5 for a TEXT DEFAULT rejection that silently dropped a whole table.

2. api/push-admin.php should recognize the OpenSSL-config failure

The catch block currently surfaces the library's message verbatim:

'VAPID keypair generation failed: ' . $e->getMessage()

which yields Unable to create the key — true, and useless. When the message is exactly that, openssl_error_string() is available and says:

error:07000072:configuration file routines::no such file

That names the actual cause. Detecting this case and returning a pointer to OPENSSL_CONF and the guide above turns a day of debugging into a sentence. This is the same principle already applied to MySQL error 1054, where db_query() turns an unknown-column error into a reply naming the column and the repair command.

---

Credit to @rjonesbsink, who diagnosed both of these on a real Windows/IIS install and verified the fix through an actual HTTP request rather than only the CLI.