feat: harden mobile gateway auth and push

[Quantumlyy]

Summary

• Harden mobile/gateway auth flows with OAuth state validation, server-side GitHub token storage, scoped mobile auth/query state, and first-run Settings access.
• Add Expo push registration plus Cloudflare scheduled polling for tracked session events, with gateway tests for auth/CORS/push registration behavior.
• Fix protocol helper exports/runtime guards and Terraform Cloudflare Worker URL/validation issues while keeping Expo secrets out of Terraform.

Verification

• pnpm --filter mobile lint
• pnpm --filter mobile exec tsc --noEmit
• pnpm --filter gateway exec tsc --noEmit
• pnpm --filter gateway test
• git diff --check

Terraform validation was not run because terraform is not installed in this environment.

---

Created with Constructor