Fix end-to-end push notification reliability

[azooz2003-bit]

Closes #6270

Fixes the production signing gap that stripped push entitlements, makes device registration account-safe and recoverable, and preserves notification identity across retries.

Adds durable Mac delivery with bounded retries, idempotent partial APNs recovery, pooled provider connections, database-backed rate enforcement, and same-account phone controls. The iPhone reports the exact blocked or limited stage and can enqueue a truthful test alert through the production path.

Verification:

• Auth runtime: 212 tests passed
• Mobile RPC decode: 23 tests passed
• Push backend: 50 unit tests passed
• Real PostgreSQL push suites: 21 tests passed
• Signing lanes: full behavioral suite passed
• Project test wiring: 644 files checked
• Hosted PushReadinessUITests: all four iPhone Simulator tests passed before an unrelated package job was cancelled: https://github.com/manaflow-ai/cmux/actions/runs/30698866070
• Durable queue E2E passed: https://github.com/manaflow-ai/cmux/actions/runs/30692920754
• Presence E2E passed: https://github.com/manaflow-ai/cmux/actions/runs/30692388017
• macOS UI E2E passed: https://github.com/manaflow-ai/cmux/actions/runs/30692389249
• Speculative merge onto current main passed every required check: https://github.com/manaflow-ai/cmux/actions/runs/30699657156
• Tagged macOS pushio build verified through /tmp/cmux-debug-pushio.sock and Computer Use. Forwarding is enabled, mode is Always, and hidden content is enabled.
• Signed iOS pushio export verified with exact application identifier 7WLXT3NR37.dev.cmux.ios.pushio, development APNs, Time Sensitive Notifications, Sign in with Apple, and strict code-sign validation.
• Aziz is paired but unreachable. The verified iOS artifact is queued for automatic install, launch, sign-in, and pairing when the phone reconnects.
• Preview warmed through the sign-in callbacks: https://cmux-4jn0yt4qm-manaflow.vercel.app

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Improves end-to-end push alert reliability across Mac, iOS, and backend with durable latest-per-id delivery, device‑delivery leases, TTL‑clamped retries, authenticated controls, and truthful readiness so users get one accurate alert even across retries, disconnects, and redirects.

• New Features

  • Mac
    • Durable latest‑per‑id queue with disk persistence, Darwin file locks, abandoned‑snapshot cleanup, and session‑identity adoption so first identity publish doesn’t drop the queue; TTL‑aware retries; truthful test stages; notifications popover opens iPhone forwarding; Settings adds forwarding, mode, and hide‑content controls.
    • Authenticated phone_push.settings.update, phone_push.status.get (definitive auth errors now trigger reauth disconnect), and idempotent phone_push.test.
  • Backend
    • Correlation‑id idempotency with merged outcomes; APNs session reuse; device‑delivery leases freeze recipients during I/O with partial‑index release; delivery survives client disconnects; provider Retry‑After honored and clamped to event TTL; unconfigured APNs provider fails closed.
    • Limits: 200 events/user/10 min; 200 devices/user; account deletion waits for active delivery leases; aggregate delivery summaries include transient/permanent failures and Retry‑After by correlation id; requires CMUX_APNS_KEY_P8, CMUX_APNS_KEY_ID, CMUX_APNS_TEAM_ID.
  • iOS
    • CmuxAuthRuntime: session‑identity stream; push registration snapshots with streaming updates, retry/backoff, failure recording, and a redirect‑preserving delegate that rejects unsafe redirects.
    • CmuxMobileShellUI: Push Readiness UI merges OS auth, registration, authenticated Mac status, and API origin with optimistic Mac settings that roll back on failure; truthful production‑path test alert; UITest preview via CMUX_UITEST_PUSH_READINESS_PREVIEW.
    • CmuxMobileRPC: authenticated Mac phone‑push status DTOs (mode, admission, queue‑persistence health, hide‑content, API origin).
  • CI/TestFlight
    • Use the “cmux Demo Distribution Push” profile; verify production APNs and Time Sensitive entitlements on export; add SwiftPM lockfile remote‑input guard (with tests) and an iOS package‑conventions lint baseline.

• Migration

  • Run DB migrations: 20260731120000_push_event_idempotency and 20260731130000_push_event_lease_fencing.
  • Set CMUX_APNS_KEY_P8, CMUX_APNS_KEY_ID, CMUX_APNS_TEAM_ID (audited at runtime).

^{Written for commit 2accaf3. Summary will update on new commits.}

Summary by CodeRabbit

• New Features
  • Added phone push forwarding controls, privacy options, delivery modes, readiness guidance, repair actions, and test alerts.
  • Added persistent, authenticated delivery with retries, expiration handling, deduplication, queue recovery, and status reporting.
  • Added notification popover access to iPhone forwarding settings.
• Bug Fixes
  • Improved permissions, device limits, account changes, failed registrations, stale sessions, redirects, and partial deliveries.
  • Improved duplicate prevention and recovery of interrupted sends.
• Localization
  • Added English and Japanese translations for push settings, alerts, statuses, and accessibility labels.
• Platform Support
  • Strengthened iOS notification entitlement validation for TestFlight builds.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[greptile-apps]

Too many files changed for review. (113 files found, 100 file limit)

Bypass the limit by tagging @greptile-apps to review.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[azooz2003-bit]

Final verification follow-up for 2accaf35f0e5c3f1fefe1210b8708e35b7780d33:

• Fresh pushon Mac preferences contain no stored push keys, so source defaults apply. The defaults/presence suite passed 40/40: https://github.com/manaflow-ai/cmux/actions/runs/30891526128
• The focused macOS Settings UI test found Mobile forwarding enabled with mode Always and passed: https://github.com/manaflow-ai/cmux/actions/runs/30890564848
• A real signed-in Simulator recording shows no system notification prompt through restoring/sign-in, followed by the system prompt over the authenticated Workspaces shell.
• The selected iOS lifecycle suite passed all 11 Swift Testing cases, including accepted registration, denied foreground recovery, one registration across repeated activation, and unregister ordering: https://github.com/manaflow-ai/cmux/actions/runs/30906042159/job/91981494843. xcodebuild printed TEST SUCCEEDED; the job badge is red because the post-test guard ignored the Swift Testing summary and misreported zero selected tests. Unrelated baseline package checks also failed.
• The signed final-tag iPhone app is dev.cmux.ios.pushon, embeds 2accaf35f0, and has the development APNs and time-sensitive entitlements.

End-to-end iPhone proof remains blocked. Aziz is paired but unavailable, so pushon remains queued for installation. The actual Allow action, actual deny to iOS Settings round trip, same-process return, and exactly one final-tag physical push are not claimed as verified. No merge was performed.