Implement push notifications Phase 1 (FCM + project relay)

Backend (Rust):
- push_tokens migration, model (PushToken/PushPlatform), and db layer
  (upsert/list/delete/delete_many)
- PUT/DELETE /api/push_tokens endpoints wired into the router + OpenAPI
- "push" notification method: relay sender (reqwest) that forwards only the
  sanitized title/body and prunes dead tokens, plus settings with a default
  relay_url
- 164 tests pass, clippy clean

Relay (push_relay/, TypeScript Firebase Cloud Function):
- POST /v1/push (firebase-admin sendEach + per-token status mapping),
  GET /healthz, payload validation, per-IP Firestore rate limiting
- Jest tests + README documenting the manual project-owned setup

Frontend (Flutter):
- oott_api_push.dart (register/unregister), push_service.dart behind a
  PushService abstraction, and a per-device push toggle in settings
- firebase_core/firebase_messaging/flutter_local_notifications deps
- 145 tests pass, dart analyze clean

Dev shell:
- add nodejs_22 to the Nix dev shell so the relay tests/build run locally

Remaining (manual, project-owned): create the Firebase project, deploy the
relay and set the real default_relay_url, add native Firebase config, and test
on real devices.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/lib/utils/api/oott_api_push.dart

@@ -0,0 +1,24 @@
+part of '../oott_api.dart';
+
+/// Push-token endpoints: register/refresh this device's FCM token so the backend
+/// can deliver push notifications to it, and unregister it when push is disabled.
+///
+/// Only the opaque FCM token and the platform travel here — no device or network
+/// data. The token is a credential, so the unregister path component is encoded.
+extension PushApi on BackendAPI {
+  /// Registers or refreshes [token] for [platform] (`android` or `ios`). Safe to
+  /// call repeatedly (e.g. on launch or after an FCM token refresh): the backend
+  /// upserts by token.
+  Future<void> registerPushToken(String token, String platform) async {
+    await _dio.put(
+      '/push_tokens',
+      data: {'token': token, 'platform': platform},
+    );
+  }
+
+  /// Unregisters [token] so this device stops receiving push notifications.
+  /// Idempotent: unregistering an unknown token still succeeds.
+  Future<void> unregisterPushToken(String token) async {
+    await _dio.delete('/push_tokens/${Uri.encodeComponent(token)}');
+  }
+}