ios: notifications, actionable approvals, Live Activity, and the relay push path

Brings the phone's ambient surfaces (UX_IOS §5/§8) to maturity:

- Notification pipeline (NotificationRouter): local notifications for
  approvals and needs-input transitions while backgrounded; low-risk
  approvals are actionable from the banner (Allow requires device
  auth, high-risk must open the app's Face ID gate); taps deep-link
  to the session; app-icon badge = NEEDS YOU count; resolutions
  withdraw the notification (first-responder-wins). The relay's
  content-free approval.pending tickle localizes via
  Localizable.strings.
- Live Activity: new NucleicRemoteWidgets extension target (lock
  screen + Dynamic Island) rendering one aggregate Activity —
  N running / M waiting + the most urgent session — started/updated/
  ended by LiveActivityManager as session state changes.
- Out-of-band push path: nucleic-edge gains POST /v1/push/register
  (admin) so the host can upload tokens for LAN-only pairings; the
  host's new PushRelayClient (config-gated on NUCLEIC_RELAY_URL +
  NUCLEIC_RELAY_ADMIN_SECRET) mirrors Hello.pushToken to the relay
  and wakes non-connected phones when an approval arrives, throttled
  per device. Everything stays off until the relay is provisioned.

Worker tests (23) and Swift suites pass apart from the pre-existing
fixture gaps and nvrsion flake. Simulated APNs delivery is blocked in
this environment (notification auth can't be granted headlessly).

Co-Authored-By: Claude Fable 5 <[email protected]>

NucleicRemote/Shared/SessionActivityAttributes.swift

@@ -0,0 +1,22 @@
+import ActivityKit
+import Foundation
+
+/// The one aggregate Live Activity (UX_IOS §5.3, aggregate per §11.4 — a single Activity
+/// respects iOS's budget better than one per session): "N running, M waiting" plus the most
+/// urgent session's title. Shared between the app (which starts/updates it) and the widget
+/// extension (which renders it).
+struct NucleicSessionAttributes: ActivityAttributes {
+    struct ContentState: Codable, Hashable {
+        /// Sessions actively working a turn.
+        var runningCount: Int
+        /// Sessions blocked on the user (approval or next prompt) — the loud number.
+        var needsYouCount: Int
+        /// The most urgent session's title: the top waiting one, else the busiest running.
+        var topTitle: String?
+        /// Whether `topTitle` is waiting on the user (amber) vs just running (blue).
+        var topNeedsYou: Bool
+    }
+
+    /// The paired Mac's name (static for the Activity's lifetime).
+    var hostName: String
+}