Deploy push relay: dev-shell tooling, real relay URL, /health route

- flake.nix: add nodejs_22, firebase-tools, and google-cloud-sdk to the dev
  shell so the relay can be tested, built, deployed, and administered locally
- backend settings: point default_relay_url at the deployed relay
- rename the relay liveness route /healthz -> /health: Google Front End
  reserves /healthz and returns its own 404 before the request reaches Cloud
  Run, so the probe was unreachable (verified live; /v1/push and the FCM path
  work end-to-end)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

push_notifications.md

@@ -97,7 +97,8 @@ Key properties:
     `firebase-admin` SDK
     (`messaging().sendEach(...)`, batched multicast) → return per-token results
     (`ok` / `unregistered` / `invalid`) so the caller can prune dead tokens.
-  - `GET /healthz` — liveness.
+  - `GET /health` — liveness. (Not `/healthz`: Google Front End reserves that
+    path and returns its own 404 before the request reaches the function.)
 - FCM client: the `firebase-admin` SDK authenticates via the function's runtime
   service account — **no service-account JSON to manage, no OAuth-token minting
   or caching code**. `sendEach` returns per-token success/error, giving us