Deploy push relay: dev-shell tooling, real relay URL, /health route

- flake.nix: add nodejs_22, firebase-tools, and google-cloud-sdk to the dev
  shell so the relay can be tested, built, deployed, and administered locally
- backend settings: point default_relay_url at the deployed relay
- rename the relay liveness route /healthz -> /health: Google Front End
  reserves /healthz and returns its own 404 before the request reaches Cloud
  Run, so the probe was unreachable (verified live; /v1/push and the FCM path
  work end-to-end)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

push_relay/.firebaserc

@@ -0,0 +1,7 @@
+{
+  "projects": {
+    "default": "oott-push"
+  },
+  "targets": {},
+  "etags": {}
+}

push_relay/README.md

@@ -29,7 +29,8 @@ full design and rationale.
   "body": "..." } }`. Returns `{ "results": [{ "token": "...", "status":
   "ok" | "unregistered" | "invalid" | "error" }] }`. The backend prunes tokens
   reported `unregistered` or `invalid`.
-- `GET /healthz` — liveness, returns `200 ok`.
+- `GET /health` — liveness, returns `200 ok`. (Not `/healthz`: that path is
+  reserved by Google Front End and never reaches the function.)
 
 Protection (Phase 1, no shared secret): FCM project scoping (the relay can only
 reach OOTT app installs), per-source-IP rate limiting, and a billing cap.

push_relay/src/app.ts

@@ -30,8 +30,10 @@ export function createApp(deps: AppDependencies): Express {
   app.set("trust proxy", true);
   app.use(express.json({ limit: "256kb" }));
 
-  // Liveness probe — no side effects, never rate limited.
-  app.get("/healthz", (_req: Request, res: Response) => {
+  // Liveness probe — no side effects, never rate limited. Note: the path
+  // `/healthz` is reserved by Google Front End (it returns its own 404 before
+  // the request reaches Cloud Run), so this uses `/health`.
+  app.get("/health", (_req: Request, res: Response) => {
     res.status(200).send("ok");
   });
 

push_relay/src/index.ts

@@ -25,6 +25,6 @@ const rateLimitStore = createFirestoreRateLimitStore(
 
 const app = createApp({ messenger, rateLimitStore });
 
-// Single HTTP function hosting both routes (POST /v1/push, GET /healthz). Scales to zero, so there
+// Single HTTP function hosting both routes (POST /v1/push, GET /health). Scales to zero, so there
 // is no idle cost and no server/OS to patch; the platform provides TLS and a stable HTTPS URL.
 export const relay = onRequest({ region: "us-central1", maxInstances: 10 }, app);