feat(relay): Add a personal background relay for APNs#95

What Changed

Adds infra/personal-relay, a background-only APNs relay for my personal iOS build (com.mwolson.t3code.v2.dev), served at t3-relay.mikemail.work. It runs on Node 24 with Postgres, accepts device and Live Activity registrations from my T3 sign-in (Clerk JWKS pinned to my account, then DPoP), and accepts signed activity publishes from enrolled environments. A separate admin CLI enrolls environments with a proof from each host and lists or revokes them; enrollment is not part of the public HTTP API. Delivery uses a Postgres alert ledger with per-channel backoff, device backfill on registration and bounded APNs payloads, sent over Node HTTP/2.

On the server side, completion alerts take their eligibility time from durable orchestration events, so a completion held by background work, monitors or PR watches alerts when the hold releases, and the publish sequence survives restarts.

T3 Connect discovery, connections and tunnels stay on relay.t3.codes. Deployment manifests and sealed secrets live in my webserver repo, not here.

Why

T3's hosted relay signs APNs with T3 Tools' key and cannot reach a personally signed bundle, so push notifications and Live Activities need a relay holding my own key. Fork-only.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes