What are cross-browser and cross-OS safe keyboard shortcuts usable for web application?

I wouldn't count on it. It's probably okay to listen for shortcuts that use the Alt modifier, but there's still no way to be sure a keyboard shortcut is free. Users can always install programs that listen for keyboard shortcuts, or use a browser you didn't expect.

If the shortcuts can be used only when the user is not typing in a textbox or something, it might be a better idea to just listen for keys pressed without a modifier key.

If no textbox or other GUI element is focused, then document.activeElement == document.body should be true (somebody correct me if I'm wrong).

I don't think there is such a list. This may even be different for different locales.

You can try to rely on the accesskey feature of HTML: http://www.w3.org/TR/html401/interact/forms.html#adef-accesskey. This should keep the number of collisions relatively small. Though I believe the Windows browsers will offer these keys as Alt+Letter which collides with the menu bar.

Alternatively do what Google reader and Gmail do: use the letters directly without any hotkey modifier. That will only work for certain types of applications, though.

Facebook uses the following ones that need different main keys to press depending on the used browser:

https://www.facebook.com/help/156151771119453?helpref=faq_content

Key Combinations for Different Browsers

Find the right combination of keys for your browser in the list below, and replace # with the access key number listed under access keys below.

Internet Explorer for PC: Alt + #, then Enter
Firefox for PC: Shift + Alt + #
Safari for Mac: Ctrl + Opt + #
Firefox for Mac: Ctrl + Opt + #
Chrome for Mac: Ctrl + Opt + #
Chrome for PC: Alt + #

Access keys
0 - Help
1 - Home
2 - Timeline
3 - Friends
4 - Inbox
5 – Notifications
6 – Settings
7 - Activity Log
8 - About
9 - Terms

However, Facebook supports these shortcuts in all browsers:

Web Messenger Keyboard Shortcuts
Ctrl + G - Search conversations
Ctrl + Q - Show/hide keyboard shortcuts
Ctrl + Delete - Archive/unarchive conversation
Ctrl + J - Mark as spam
Ctrl + M - Start a new message
Ctrl + I - Go to Inbox
Ctrl + U - Go to Other

Conclusion: Some shortcuts might work in all browsers, but most of them need additional explanation.