fix(auth-server): do not await push sends in three routes

[vbudhram]

Because

• Routes that send a push notification show 1-3 minute timeouts in Grafana. A push send can take a minute or longer while it contacts APNS, and the client waits on it.
• notifyAccountUpdated sat inside the try of accountAndTokenVerification, whose catch rethrows. A push failure could turn a successful sign-in confirmation into a 500 after the database write had already committed.

This pull request

• Drops the await on push.sendPush in devices-and-sessions.js, and on push.notifyDeviceConnected and push.notifyAccountUpdated in emails.js.
• Adds a .catch() that logs at each of the three sites. push.js rethrows per-device send errors, so a bare floating promise would become an unhandled rejection.
• Adds a test per site. The devices-and-sessions test holds the send pending, so an accidental re-await hangs the test instead of passing.
• Leaves notifyCommandReceived awaited. That route returns notified and notifyError in its response body, so the push result is part of the API contract.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-5807

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: lib/routes/emails.js and lib/routes/devices-and-sessions.js
• Suggested review order: the two route files, then their specs
• Risky or complex parts: the notifyAccountUpdated site. A push failure there no longer fails the request, so the caller now gets a 200 where it used to get a 500.

Screenshots (Optional)

No user interface change.

Other information (Optional)

• npx jest --selectProjects unit --findRelatedTests over the four files: 220 passed, 0 failed. npx nx lint fxa-auth-server: exit 0.
• The repo has other un-awaited push sends (routes/account.ts, routes/password.ts, routes/utils/signup.js, lib/devices.js, and emails.js notifyProfileUpdated) that carry no .catch(). They look like the same latent unhandled-rejection risk, but this change leaves them alone to stay narrow.
• Functional tests were not run for this change.

[Copilot]

Pull request overview

Prevents slow push sends from blocking auth-server responses while safely logging rejected promises.

Changes:

• Makes three push notifications fire-and-forget.
• Adds rejection logging and regression tests.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
emails.js	Makes two verification-flow notifications non-blocking.
emails.spec.ts	Tests rejection logging and successful responses.
devices-and-sessions.js	Makes device notifications non-blocking.
devices-and-sessions.spec.ts	Tests response timing and rejection logging.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[vbudhram]

This PR lgtm, it is small and well scoped, r+