Close coverage gaps and add a CI coverage gate

[j0shcap]

Summary

• Payload serialization test suite: PayloadAlert (all localized fields), structured alerts, badge-zero semantics, background pushes, mutable-content, custom top-level data — the vendored payload module was at 42%, and wrong key names would be silently ignored by APNs rather than rejected
• Remaining gaps closed: optional APNs headers (priority/expiration/collapse-id), background push-type inference, no-topic requests, ExpiredToken as a raised exception, root endpoint, real db_session generator (asserts the pooled connection is released), and a no-SQL guarantee for empty prune lists via statement capture
• Source coverage is now 99% (the only misses are the main block, which integration tests execute as a subprocess); CI gates at 95 with --cov-fail-under
• pytest.ini folded into pyproject.toml; ruff/mypy pinned in the workflow so tool releases can't break CI

Test plan

• 92 unit/API tests + 9 integration pass; ruff, format check, mypy clean; the exact CI command (pytest --cov=. --cov-fail-under=95) verified locally