Modernize internals: registration contract, APNs client cleanup, cert auth

[j0shcap]

Summary

Registration contract (bug fix + API hygiene)

• New DeviceRegistration request model; Device (with server-assigned id/timestamps) is now response-only. Server-managed fields sent by clients are ignored instead of trusted
• Fixes a confirmed DoS: registering with a colliding client-supplied id sent the IntegrityError retry into infinite recursion, wedging the worker thread. Reproduced by test first
• Wire-compatible: extra request fields are ignored, response shape unchanged

Certificate auth is now supported and tested

• APNS_CERT_PATH/APNS_CERT_PASSWORD switch the handler to certificate credentials; token (.p8) auth remains the default
• Tests cover credential selection, cert loading, and that cert auth sends no authorization header (self-signed test fixture)

Vendored APNs client cleanup

• Removed constructor params accepted but silently ignored since the httpx migration (proto, proxy_*, heartbeat_period) and the unused topic param on JWT header generation
• Transport internalized (_send), explicit request timeout, StrEnum/NamedTuple, no name mangling, push-type inference as a data table
• PushConfig class-attribute caching removed (the handler is already a process singleton)

Entrypoint + docs

• python main.py honors HOST/PORT; integration tests now launch the server exactly as the README documents
• README rewritten: canonical clone URL, PostgreSQL in prerequisites, paste-able Quickstart (executed end-to-end from a clean clone to verify), valid register example, response/idempotency documented, /docs pointer, Swift device-token snippet, production notes, current feature list

Test plan

• 81 tests pass (72 unit/API + 9 Postgres integration, now booting via python main.py); ruff, format check, and mypy clean
• Rewritten client verified live against Apple's APNs sandbox (typed InvalidProviderToken for the throwaway key)
• Quickstart validated literally: fresh clone, template .env, Dockerized Postgres, registration and auth verified over HTTP