feat(backend): push notifications module (FCM HTTP v1)

New global push/ module mirroring mail/ and files/storage/:
- PushProvider abstraction; default LogPushProvider (no delivery, logs),
  PUSH_PROVIDER=fcm switches to FcmPushProvider — Firebase Cloud Messaging
  HTTP v1, authenticated by a service-account JWT exchanged for an OAuth
  token (no extra dependency; jsonwebtoken does the signing). Prunes tokens
  FCM reports as invalid.
- DeviceToken model (token + platform, bound to a User or GuestAccount),
  migration + added to the sync log.
- POST /api/push/register + /unregister (any of the three token kinds).
- PushService.notifyChannel() resolves a channel's readable audience
  (DIREKT participants / LT / Gemeinde members + guests / whole KC for
  broadcast), looks up their device tokens (minus the sender), sends.
- ChatService.sendMessage() fires it best-effort after persisting.

New env: PUSH_PROVIDER, FCM_PROJECT_ID (default konfi-castle-app),
GOOGLE_APPLICATION_CREDENTIALS.

Verified against local Postgres: register a token, send a Gemeinde-group
chat message from another member -> log-push logs "would push ... to 1
device". Real FCM send needs the service-account JSON. npm test 56.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/chat/chat.service.ts

@@ -4,16 +4,25 @@ import { PrismaClient } from '../prisma/prisma.module';
 import { AuthenticatedUser } from '../auth/authenticated-request';
 import { GuestJwtPayload } from '../auth/guest-auth.service';
 import { SyncService } from '../sync/sync.service';
+import { PushService } from '../push/push.service';
 
 export type ChatCaller =
   | { kind: 'user'; user: AuthenticatedUser }
   | { kind: 'guest'; guest: GuestJwtPayload };
 
+const CHANNEL_TITLES: Record<ChatChannelType, string> = {
+  [ChatChannelType.GEMEINDE_GRUPPE]: 'Gemeinde-Gruppe',
+  [ChatChannelType.DIREKT]: 'Direktnachricht',
+  [ChatChannelType.LT_UEBERGREIFEND]: 'Leitungsteam',
+  [ChatChannelType.BROADCAST]: 'Ankündigung',
+};
+
 @Injectable()
 export class ChatService {
   constructor(
     private readonly prisma: PrismaClient,
     private readonly sync: SyncService,
+    private readonly push: PushService,
   ) {}
 
   async createChannel(kcId: string, type: ChatChannelType, gemeindeId?: string) {
@@ -142,7 +151,7 @@ export class ChatService {
   }
 
   async sendMessage(channelId: string, caller: ChatCaller, body: string) {
-    await this.assertCanWrite(channelId, caller);
+    const channel = await this.assertCanWrite(channelId, caller);
     const message = await this.prisma.chatMessage.create({
       data: {
         channelId,
@@ -152,6 +161,20 @@ export class ChatService {
       },
     });
     await this.sync.capture('ChatMessage', SyncOperation.CREATE, message.id, message);
+
+    void this.push.notifyChannel(
+      channelId,
+      {
+        title: CHANNEL_TITLES[channel?.type ?? ChatChannelType.GEMEINDE_GRUPPE],
+        body: body.length > 140 ? `${body.slice(0, 137)}…` : body,
+        data: { channelId },
+      },
+      {
+        userId: caller.kind === 'user' ? caller.user.userId : null,
+        guestId: caller.kind === 'guest' ? caller.guest.guestId : null,
+      },
+    );
+
     return message;
   }