ios: notifications, actionable approvals, Live Activity, and the relay push path

Brings the phone's ambient surfaces (UX_IOS §5/§8) to maturity:

- Notification pipeline (NotificationRouter): local notifications for
  approvals and needs-input transitions while backgrounded; low-risk
  approvals are actionable from the banner (Allow requires device
  auth, high-risk must open the app's Face ID gate); taps deep-link
  to the session; app-icon badge = NEEDS YOU count; resolutions
  withdraw the notification (first-responder-wins). The relay's
  content-free approval.pending tickle localizes via
  Localizable.strings.
- Live Activity: new NucleicRemoteWidgets extension target (lock
  screen + Dynamic Island) rendering one aggregate Activity —
  N running / M waiting + the most urgent session — started/updated/
  ended by LiveActivityManager as session state changes.
- Out-of-band push path: nucleic-edge gains POST /v1/push/register
  (admin) so the host can upload tokens for LAN-only pairings; the
  host's new PushRelayClient (config-gated on NUCLEIC_RELAY_URL +
  NUCLEIC_RELAY_ADMIN_SECRET) mirrors Hello.pushToken to the relay
  and wakes non-connected phones when an approval arrives, throttled
  per device. Everything stays off until the relay is provisioned.

Worker tests (23) and Swift suites pass apart from the pre-existing
fixture gaps and nvrsion flake. Simulated APNs delivery is blocked in
this environment (notification auth can't be granted headlessly).

Co-Authored-By: Claude Fable 5 <[email protected]>

NucleicRemote/NucleicRemote/Views/SessionsView.swift

@@ -74,7 +74,10 @@ struct SessionsView: View {
                     !raw.isEmpty, path.isEmpty {
                     path.append(SessionID(rawValue: raw))
                 }
+                consumeRoute()
             }
+            // A notification tap while this tab is already up.
+            .onChange(of: store.pendingRoute) { consumeRoute() }
             .toolbar {
                 ToolbarItem(placement: .topBarTrailing) {
                     Button {
@@ -87,6 +90,13 @@ struct SessionsView: View {
             .safeAreaInset(edge: .bottom) { ConnectionChip().padding(.bottom, 8) }
         }
     }
+
+    /// Push the session a notification tap asked for, then clear the request.
+    private func consumeRoute() {
+        guard let route = store.pendingRoute else { return }
+        store.pendingRoute = nil
+        path.append(route)
+    }
 }
 
 struct SessionRow: View {