RFC: Push notification subscriptions

Source PR: #87 · docs/rfcs/push-notification-subscriptions.md · @pgherveou

Description

Four methods let a product manage the (signer, topic) push whitelist on the user's own device; the backend pushes when a matching signed statement appears on the Statement Store. A fifth, push_broadcast, is an interim publish path where the host binds signer itself.

Motivation

Push v2 puts delivery behind a whitelist the user controls, but no TrUAPI method can edit it. Push tokens must stay in the backend and never reach a product.

Requirements

• signer is mandatory on every rule, and every operation is scoped to the calling user's own subscription.
• add and remove are idempotent; set replaces the whole set atomically; list is read-only.
• The product never sees a push token.
• push_broadcast is interim, and its signer is not product-overridable.

Tasks

• RFC document body
• Implementation — rust-core
• Implementation — hosts
  • dotli
  • Desktop
  • iOS
  • Android
  • host-cli