feat(push): add public APNs gateway

[tlongwell-block]

Summary

• define the normative NIP-PL Push Leases protocol and fixed wake-payload invariant
• add a standalone, capability-gated APNs gateway with App Attest enrollment, durable PostgreSQL authority, replay/quota fencing, bounded retries, token-safe telemetry, and retention
• add the production Helm chart, private health/metrics surface, alerts, multi-platform image publication, provenance attestation, and operator runbook
• harden relay lease admission and durable outbox primitives while explicitly leaving client capability handoff, indexed event matching/enqueue, and the relay delivery worker to follow-up integration

Safety boundary

The gateway is a blind last hop. Every APNs application body is the same compile-time constant; relay-controlled data can select only an authorized opaque endpoint capability and bounded protocol headers. This PR does not claim end-to-end iOS push delivery: the iOS enrollment/delegation producer and relay matcher/worker are documented follow-ups.

Validation

• cargo test -p buzz-push-gateway --lib -- --include-ignored against ephemeral PostgreSQL: 18 passed
• cargo test -p buzz-relay --lib: 574 passed, 0 failed, 11 ignored
• cargo test -p buzz-db --lib: 79 passed
• deploy/charts/buzz-push-gateway/tests/render.sh: pass, including negative schema cases
• fixed-payload formal model: 256 combinations hold; all 8 mutation categories caught
• pre-push repository suite with Hermit Rust 1.95: pass
• cargo fmt, staged/unstaged diff checks, and pre-commit hooks: pass

Independent review

Exact SHA 7023e8bd03cea76e5e3ebb448dd4ba6ba846560f was independently re-grounded and approved for:

• overall architecture/security and APNs-body noninterference
• PostgreSQL admission/replay linearization and race behavior
• retention FK ordering
• image provenance and immutable Helm deployment linkage