Push: device-token lifecycle (`POST /api/push/register` / `DELETE /api/push/unregister`)

[Adron]

Part of #44 — Push notifications: real device push (FCM) to replace the WorkManager poll

• Register the FCM token on first grant and on every token rotation.
• Unregister on sign-out and on account deletion — a stale token means notifications for one
  account land on a device someone else is now signed in on.
• Request POST_NOTIFICATIONS at a moment that earns the grant rather than on cold start, and
  keep the app fully functional when it is denied.
• Reuse the existing session/auth lifecycle hooks in :feature:auth rather than adding a new
  one.

Tests: register on new token; unregister on sign-out; denied-permission path.

---

Filed from the parity review of feature/parity-wip @ 14d7795 against interlinedlist.com (OpenAPI /api/openapi.json, 233 paths) and the public help centre.

[Adron]

Implemented in #106 (branch issue/46-push-token-lifecycle). Closing here — review and any follow-up happens on the PR.

This was filed as blocked behind #45, but only the token source actually is. /help/api/push-notifications documents the server contract in full and I confirmed live that POST /api/push/register is bearer-authenticated and that platform accepts android — so the whole lifecycle is buildable and testable now, with the FCM token behind a PushTokenProvider seam. No Firebase plugin or dependency was added; landing #45 is a single binding swap.

The security-relevant half is the part worth reviewing: unregister-on-sign-out hangs off AuthRepository.logout() via a SessionTeardownTask multibinding, run before the session token is cleared, so no sign-out path can bypass it — including account deletion, which already routes through the same method. A stale token would otherwise deliver one account's notifications to a device someone else has since signed in on.

POST_NOTIFICATIONS is asked when the user turns on a Push channel in Notification preferences rather than at cold start. Consequence worth knowing: a user who never visits that screen is never asked, so on Android 13+ the existing poll's tray notifications stay silent for them.

#47 and #48 remain blocked on #45.