feat(backend): push notifications module (FCM HTTP v1)

New global push/ module mirroring mail/ and files/storage/:
- PushProvider abstraction; default LogPushProvider (no delivery, logs),
  PUSH_PROVIDER=fcm switches to FcmPushProvider — Firebase Cloud Messaging
  HTTP v1, authenticated by a service-account JWT exchanged for an OAuth
  token (no extra dependency; jsonwebtoken does the signing). Prunes tokens
  FCM reports as invalid.
- DeviceToken model (token + platform, bound to a User or GuestAccount),
  migration + added to the sync log.
- POST /api/push/register + /unregister (any of the three token kinds).
- PushService.notifyChannel() resolves a channel's readable audience
  (DIREKT participants / LT / Gemeinde members + guests / whole KC for
  broadcast), looks up their device tokens (minus the sender), sends.
- ChatService.sendMessage() fires it best-effort after persisting.

New env: PUSH_PROVIDER, FCM_PROJECT_ID (default konfi-castle-app),
GOOGLE_APPLICATION_CREDENTIALS.

Verified against local Postgres: register a token, send a Gemeinde-group
chat message from another member -> log-push logs "would push ... to 1
device". Real FCM send needs the service-account JSON. npm test 56.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -31,6 +31,14 @@ SMTP_SECURE="false"
 SMTP_USER=""
 SMTP_PASS=""
 
+# Push: defaults to "log" (no delivery). Set PUSH_PROVIDER=fcm plus
+# FCM_PROJECT_ID and GOOGLE_APPLICATION_CREDENTIALS (path to a Firebase
+# service-account JSON with the "Firebase Cloud Messaging API" enabled) to
+# send real notifications via FCM HTTP v1.
+PUSH_PROVIDER="log"
+FCM_PROJECT_ID="konfi-castle-app"
+GOOGLE_APPLICATION_CREDENTIALS="/absolute/path/to/serviceAccount.json"
+
 # File storage: defaults to Nextcloud via WebDAV; set STORAGE_PROVIDER=s3 to
 # use an S3-compatible bucket instead (see S3_* vars below).
 STORAGE_PROVIDER="webdav"