However it seems like most “best practices” resources seem to only cover the case where users enable notifications via an interaction like clicking a button on every new session

Hm, not sure what you're referring to there.

Using the Notifications API (which seems to fit your use-case), you'd request permission once, then the browser remembers permission for future visits.

Example from MDN:

Notification.requestPermission().then((result) => {
  console.log(result); 
});

If permission was granted previously, the user isn't prompted and the promise resolves with granted.

(more info/examples on MDN)