Mobile notifications for iOS (#210)

* mobile: wire notification registration and listener

* implement backend components for push notifications

* refactor: agentic comment cleanup

* docs: use proper module name for particle processor

* set required env variables for push notifications

* bump version

* fix: always upsert push token on mobile start

* Revert "fix: always upsert push token on mobile start"

This reverts commit 90ff18a788.

* send push notifications regardless of online status

go/internal/middleware/auth.go

@@ -17,40 +17,35 @@ const (
 	isAdminContextKey contextKey = "isAdmin"
 )
 
-// WithEmail adds the email to the context
 func WithEmail(ctx context.Context, email string) context.Context {
 	return context.WithValue(ctx, emailContextKey, email)
 }
 
-// EmailFromContext extracts the email from the context
 func EmailFromContext(ctx context.Context) (string, bool) {
 	email, ok := ctx.Value(emailContextKey).(string)
 	return email, ok
 }
 
-// WithHumanId adds the humanId to the context
 func WithHumanId(ctx context.Context, humanId string) context.Context {
 	return context.WithValue(ctx, humanIdContextKey, humanId)
 }
 
-// HumanIdFromContext extracts the id from the context
 func HumanIdFromContext(ctx context.Context) (string, bool) {
 	humanId, ok := ctx.Value(humanIdContextKey).(string)
 	return humanId, ok
 }
 
-// WithIsAdmin adds the admin flag to the context
 func WithIsAdmin(ctx context.Context, isAdmin bool) context.Context {
 	return context.WithValue(ctx, isAdminContextKey, isAdmin)
 }
 
-// IsAdminFromContext extracts the admin flag from the context
 func IsAdminFromContext(ctx context.Context) bool {
 	isAdmin, ok := ctx.Value(isAdminContextKey).(bool)
 	return ok && isAdmin
 }
 
-// Auth returns a middleware that validates the session token and adds the email to the context
+// Auth validates the bearer session token and populates email/humanId/isAdmin
+// into the request context for downstream handlers.
 func Auth(authSvc auth.AuthService) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -66,7 +61,6 @@ func Auth(authSvc auth.AuthService) func(http.Handler) http.Handler {
 				return
 			}
 
-			// Auto-extend session
 			if err := authSvc.ExtendSession(r.Context(), token); err != nil {
 				slog.Warn("failed to extend session", "error", err)
 			}
@@ -79,7 +73,6 @@ func Auth(authSvc auth.AuthService) func(http.Handler) http.Handler {
 	}
 }
 
-// extractBearerToken extracts the token from the Authorization header
 func extractBearerToken(r *http.Request) string {
 	authHeader := r.Header.Get("Authorization")
 	if authHeader == "" {