Add lint and type checking, update APNs client to current Apple spec

[j0shcap]

Summary

Tooling (pyproject.toml + CI)

• ruff lint config (pycodestyle, pyflakes, isort, naming, pyupgrade, bugbear, simplify) — 44 findings fixed, now clean
• mypy config — 15 findings fixed across 24 files, now clean
• CI workflow now runs ruff check, ruff format --check, and mypy alongside pytest, with setup-python v5 and pip caching

Code improvements from lint findings

• Removed the root-level __init__.py that made the repo a pseudo-package (broke mypy and ruff module resolution)
• DeviceEntity converted to SQLAlchemy 2.0 typed Mapped/mapped_column style
• Explicit __all__ re-exports in all packages; snake_case dependency parameters; f-strings over %-formatting; stale # type: comments replaced with real annotations

APNs client updated to Apple's current spec

Reviewed against Apple's current provider API and error docs:

• Sandbox host api.development.push.apple.com → the documented api.sandbox.push.apple.com (verified live against Apple's sandbox)
• ExpiredToken (410) now prunes devices like Unregistered — Apple's newer second "token is dead" reason was previously ignored, so expired tokens would be re-pushed forever
• Added InvalidPushType, BadEnvironmentKeyIdInToken, UnrelatedKeyIdInToken exceptions and liveactivity/pushtotalk/location/widgets/controls push-type inference

Test plan

• 41 tests pass; ruff and mypy clean; every CI step verified locally
• Live e2e against Apple's real sandbox endpoint on the new hostname: HTTP/2 + ES256 JWT accepted, typed InvalidProviderToken returned for the throwaway test key