feat(push): wire Capacitor native push into the web UI

home.html: in a Capacitor app shell, setupPush() now uses the native FCM/APNs path
instead of Web Push — requests permission, registers, POSTs the OS device token to
/api/v1/devices, deep-links on notification tap (selectChat), and unregisters the
token on logout. Web Notification prompts are suppressed on native. Fully inert in a
normal browser (Web Push unchanged). build batch15.

CLIENTS.md Phase B push items checked off.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLIENTS.md

@@ -60,8 +60,11 @@ absolute API base if offline-launch or store policy requires it.
       tokens are pruned on 404/410/UNREGISTERED. (db `device_tokens`, repo `deviceTokens`,
       `push.js`.) *Mobile app still needs the Capacitor push plugin wired + FCM/APNs creds
       to deliver end-to-end.*
-- [ ] **Wire the Capacitor push plugin** in the mobile app → register the token via
-      `POST /api/v1/devices` on launch; handle taps (deep link to the chat/session).
+- [x] **Capacitor push plugin wired** in the web UI (`setupNativePush` in home.html):
+      inside the app it requests permission, registers, and `POST`s the FCM/APNs token to
+      `/api/v1/devices`; notification taps deep-link via `selectChat`; logout unregisters the
+      token. Web Push is skipped when running natively. Inert in a normal browser. *Activates
+      once the Capacitor Android/iOS app is built and FCM/APNs creds are set.*
 - [ ] **Mobile screen capture** for "Share Screen" from a phone (ReplayKit / MediaProjection plugin).
 - [ ] **Deep links / universal links** so a session/meeting link opens the app.