feat(server): deliver push without a Firebase project

Every notification depended on Firebase Cloud Messaging, so a missing
Firebase project, which is the current state, meant no notification could be
delivered on any platform. Web Push and token-based Apple Push are now first
class transports alongside FCM, chosen per registered device, and a scheduled
Cloudflare Worker drain retries an outbox so a provider outage delays rather
than drops a message.

.env.example

@@ -70,8 +70,25 @@ D3RO_ADMOB_REWARDED_UNIT_ID=
 # Email and push providers
 RESEND_FROM=
 RESEND_API_KEY=
+# Android push transport (Firebase Cloud Messaging). Required only for Android.
 FCM_SERVICE_ACCOUNT_JSON=
 FCM_PROJECT_ID=
+# Web Push transport (Firebase-free). VAPID keys; subject must be mailto: or https:.
+WEBPUSH_VAPID_PUBLIC_KEY=
+WEBPUSH_VAPID_PRIVATE_KEY=
+WEBPUSH_SUBJECT=
+# Apple Push Notification service transport (Firebase-free). Token-based .p8 auth.
+APNS_KEY_ID=
+APNS_TEAM_ID=
+APNS_PRIVATE_KEY=
+APNS_TOPIC=com.d3ro.voice
+APNS_ENVIRONMENT=production
+
+# Cloudflare Worker push-outbox cron drain. Set SUPABASE_SERVICE_ROLE_KEY as a
+# worker secret (`wrangler secret put`), never in this file.
+D3RO_WORKER_SUPABASE_URL=
+D3RO_WORKER_SUPABASE_SERVICE_ROLE_KEY=
+D3RO_WORKER_PUSH_DRAIN_BATCH_LIMIT=20
 
 # Optional authenticated mobile E2E account, stored only in CI secrets or local .env.
 MOBILE_E2E_EMAIL=