Re-register push token at launch; refactor push_service

After a cold restart the app considered push enabled (from prefs) but never
re-registered its FCM token, so a rotated token (or a backend that lost its token
store) left the backend delivering to nothing while the test button still
reported success. Re-register the current token at launch so the backend
converges to the live token on every start, and re-attach the foreground display
handler then too (it was previously only wired during enable()).

Also tidy push_service.dart: a single initPushOnLaunch() startup entry point so
main.dart needs no push internals, one owner for the persisted push-enabled flag
(pushEnabledOnThisDevice / setPushEnabledOnThisDevice) instead of a hard-coded key
in four places, private internal helpers, deduped platform checks, and section
grouping. enable() now reuses the shared token-registration path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/lib/main.dart

@@ -32,13 +32,12 @@ void main() {
         );
       }
 
-      // Initialize Firebase at launch so the firebase_messaging plugin's iOS
-      // APNs swizzling has a configured app to forward the device token to;
-      // without this getAPNSToken() never resolves and enabling push fails.
+      // Resume push at launch (Firebase init + foreground handler + token
+      // re-registration when already enabled); see initPushOnLaunch.
       try {
-        await initFirebaseForPush();
+        await initPushOnLaunch();
       } catch (e, stack) {
-        debugPrint('Firebase init for push failed, continuing: $e\n$stack');
+        debugPrint('Push launch init failed, continuing: $e\n$stack');
       }
 
       // Settle iOS's local-network permission now, at launch, so it isn't