feat(push): M7 backend — opt-in push notifications via self-hosted ntfy

Additive, v1-only backend contract for the Android app's opt-in push (Part 1 of
M7; docs/android/PLAN.md §11). The app is a pure consumer — this lands the
endpoints, fan-out, and relay it needs.

- Schema: push_devices (per-device endpoint) + notification_subscriptions
  (per-user opted-in streams), FK→users ON DELETE CASCADE.
- Stream catalog + event→stream mapping (config/notificationStreams.js): public
  streams (news.post, server.status, idoc.warning, champ.start, governor.election)
  drawn ONLY from the SSE PUBLIC_KINDS allowlist; personal owner-keyed streams
  (vendor.sale, house.idoc, account.login). Full-state upserts (champ/city) fire
  only on a real transition via an injectable tracker.
- Fan-out (utils/pushDispatch.js): content-free tickles ({ stream, ref }) POSTed
  to each subscribed device; never throws. Two producers — shardIngest.ingest
  (beside the SSE broadcast) and the create/publish-post path (news.post).
  Personal events resolve to the owner via shardLinks. SSRF guard: endpoints must
  be HTTPS, non-private, and on the NTFY_BASE_URL/NTFY_ALLOWED_ORIGINS allow-set —
  enforced at registration and every publish.
- Routes under the role-agnostic self surface (never /admin): POST|GET
  /auth/me/devices, DELETE /auth/me/devices/:id, GET
  /auth/me/notifications/streams, GET|PUT /auth/me/notifications/subscriptions.
  Swagger regenerated (4 paths, PushDevice/NotificationStreams/etc. schemas).
- ntfy service in docker-compose.yml: pinned image, declarative ./ntfy/server.yml,
  no published host port, anonymous unguessable topics (no accounts) — zero
  interactive setup. No publish token required (content-free design); optional
  NTFY_PUBLISH_TOKEN honored.
- Tests: pushDispatch (mapping, PUBLIC_KINDS gate, owner-keying, SSRF guard,
  content-free payload) + notifications route auth gate. Full suite green (247).

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/router/v1/admin/admin.controller.js

@@ -5,6 +5,7 @@ const users = require('../../../model/users/users.model')
 const activity = require('../../../model/activity/activity.model')
 const announceJobs = require('../../../model/announceJobs/announceJobs.model')
 const newsGump = require('../../../utils/newsGump')
+const pushDispatch = require('../../../utils/pushDispatch')
 const { cleanBody } = require('../../../utils/sanitizeHtml')
 
 const log = require('../../../utils/logger')('admin')
@@ -22,12 +23,23 @@ const log = require('../../../utils/logger')('admin')
 // (post.announce_job_id) reliable against rapid double-publishes. Still guarded:
 // enqueueIfNeeded swallows its own errors, so a pipeline hiccup can't break save.
 async function announceIfNewlyPublished(post, transition) {
-  await announceJobs.enqueueIfNeeded(post, transition)
+  // enqueueIfNeeded returns a truthy job id EXACTLY on a real transition into
+  // published news (and null on an edit/re-publish or a hiccup) — reuse that as
+  // the single "newly published news" signal for the push too, so we never
+  // double-fire on edits or replicate the transition logic.
+  const jobId = await announceJobs.enqueueIfNeeded(post, transition)
   // Keep the in-game Town Cryer News gump in sync with the same transition: push
   // the article when it becomes published news, refresh it silently on an edit,
   // and pull it when it leaves published-news. Best-effort (never throws), so a
   // sidecar hiccup never breaks saving a post — same guarantee as the enqueue.
   await newsGump.syncPost(post, transition)
+  // Opt-in push tickle to news.post subscribers, on the same transition.
+  // Fire-and-forget + self-guarding, so a dead ntfy relay never breaks saving.
+  if (jobId) {
+    Promise.resolve(pushDispatch.publish('news.post', { ref: String(post.id) })).catch((err) =>
+      log.warn('news push failed', { postId: post.id, message: err.message }),
+    )
+  }
 }
 
 // ── Dashboard & site mode ─────────────────────────────────────────────