Mobile notifications for iOS (#210)

* mobile: wire notification registration and listener

* implement backend components for push notifications

* refactor: agentic comment cleanup

* docs: use proper module name for particle processor

* set required env variables for push notifications

* bump version

* fix: always upsert push token on mobile start

* Revert "fix: always upsert push token on mobile start"

This reverts commit 90ff18a788.

* send push notifications regardless of online status

go/internal/middleware/auth.go

@@ -17,40 +17,35 @@ const (
 	isAdminContextKey contextKey = "isAdmin"
 )
 
-// WithEmail adds the email to the context
 func WithEmail(ctx context.Context, email string) context.Context {
 	return context.WithValue(ctx, emailContextKey, email)
 }
 
-// EmailFromContext extracts the email from the context
 func EmailFromContext(ctx context.Context) (string, bool) {
 	email, ok := ctx.Value(emailContextKey).(string)
 	return email, ok
 }
 
-// WithHumanId adds the humanId to the context
 func WithHumanId(ctx context.Context, humanId string) context.Context {
 	return context.WithValue(ctx, humanIdContextKey, humanId)
 }
 
-// HumanIdFromContext extracts the id from the context
 func HumanIdFromContext(ctx context.Context) (string, bool) {
 	humanId, ok := ctx.Value(humanIdContextKey).(string)
 	return humanId, ok
 }
 
-// WithIsAdmin adds the admin flag to the context
 func WithIsAdmin(ctx context.Context, isAdmin bool) context.Context {
 	return context.WithValue(ctx, isAdminContextKey, isAdmin)
 }
 
-// IsAdminFromContext extracts the admin flag from the context
 func IsAdminFromContext(ctx context.Context) bool {
 	isAdmin, ok := ctx.Value(isAdminContextKey).(bool)
 	return ok && isAdmin
 }
 
-// Auth returns a middleware that validates the session token and adds the email to the context
+// Auth validates the bearer session token and populates email/humanId/isAdmin
+// into the request context for downstream handlers.
 func Auth(authSvc auth.AuthService) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -66,7 +61,6 @@ func Auth(authSvc auth.AuthService) func(http.Handler) http.Handler {
 				return
 			}
 
-			// Auto-extend session
 			if err := authSvc.ExtendSession(r.Context(), token); err != nil {
 				slog.Warn("failed to extend session", "error", err)
 			}
@@ -79,7 +73,6 @@ func Auth(authSvc auth.AuthService) func(http.Handler) http.Handler {
 	}
 }
 
-// extractBearerToken extracts the token from the Authorization header
 func extractBearerToken(r *http.Request) string {
 	authHeader := r.Header.Get("Authorization")
 	if authHeader == "" {

go/internal/middleware/cors.go

@@ -2,7 +2,7 @@ package middleware
 
 import "net/http"
 
-// CORS wraps a handler to add CORS headers and handle preflight requests.
+// CORS adds CORS headers and short-circuits preflight requests.
 func CORS(allowedOrigins []string) func(http.Handler) http.Handler {
 	originSet := make(map[string]struct{}, len(allowedOrigins))
 	for _, o := range allowedOrigins {
@@ -13,7 +13,7 @@ func CORS(allowedOrigins []string) func(http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			origin := r.Header.Get("Origin")
 
-			// Check if the origin is allowed (empty allowedOrigins means allow all)
+			// Empty allowedOrigins means allow all.
 			allowed := len(originSet) == 0
 			if !allowed {
 				_, allowed = originSet[origin]
@@ -27,7 +27,6 @@ func CORS(allowedOrigins []string) func(http.Handler) http.Handler {
 				w.Header().Set("Access-Control-Max-Age", "86400")
 			}
 
-			// Handle preflight
 			if r.Method == http.MethodOptions {
 				w.WriteHeader(http.StatusNoContent)
 				return