Implement push notifications Phase 1 (FCM + project relay)

Backend (Rust):
- push_tokens migration, model (PushToken/PushPlatform), and db layer
  (upsert/list/delete/delete_many)
- PUT/DELETE /api/push_tokens endpoints wired into the router + OpenAPI
- "push" notification method: relay sender (reqwest) that forwards only the
  sanitized title/body and prunes dead tokens, plus settings with a default
  relay_url
- 164 tests pass, clippy clean

Relay (push_relay/, TypeScript Firebase Cloud Function):
- POST /v1/push (firebase-admin sendEach + per-token status mapping),
  GET /healthz, payload validation, per-IP Firestore rate limiting
- Jest tests + README documenting the manual project-owned setup

Frontend (Flutter):
- oott_api_push.dart (register/unregister), push_service.dart behind a
  PushService abstraction, and a per-device push toggle in settings
- firebase_core/firebase_messaging/flutter_local_notifications deps
- 145 tests pass, dart analyze clean

Dev shell:
- add nodejs_22 to the Nix dev shell so the relay tests/build run locally

Remaining (manual, project-owned): create the Firebase project, deploy the
relay and set the real default_relay_url, add native Firebase config, and test
on real devices.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/test/api/push_api_test.dart

@@ -0,0 +1,33 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:frontend/utils/oott_api.dart';
+import 'package:http_mock_adapter/http_mock_adapter.dart';
+
+import '../helpers/backend_test_harness.dart';
+
+void main() {
+  late DioAdapter adapter;
+
+  setUp(() async {
+    adapter = await setUpBackendForTest();
+  });
+
+  test('registerPushToken PUTs the token and platform', () async {
+    adapter.onPut(
+      '/push_tokens',
+      (server) => server.reply(200, null),
+      data: {'token': 'fcm-token-123', 'platform': 'android'},
+    );
+
+    await BackendAPI.instance.registerPushToken('fcm-token-123', 'android');
+  });
+
+  test('unregisterPushToken DELETEs the encoded token path', () async {
+    // A token can contain characters that must be percent-encoded in the path.
+    adapter.onDelete(
+      '/push_tokens/tok%2Fwith%3Aspecial',
+      (server) => server.reply(200, null),
+    );
+
+    await BackendAPI.instance.unregisterPushToken('tok/with:special');
+  });
+}