Push notifications

Makes remote push correct on iOS and Android: the permission is asked only when the person sees why, the server always holds this device's current token (and drops it at sign-out), Android channels and data kinds match a written contract with the server, a tap opens exactly the screen it is about and nothing a payload names, and one foreground policy decides what shows while the app is open. A zero-dependency checker proves the structure; Jest tests over a fake port prove the behaviour.

Rules that must hold