Default push backend to ntfy; FCM opt-in with privacy warning (issue #10)

- IRIS_PUSH_BACKEND now defaults to ntfy (keeps push metadata on your own
  infrastructure); FCM is opt-in via IRIS_PUSH_BACKEND=fcm
- build_push_backend(): ntfy for empty/unknown names, FCM only on explicit 'fcm'
- gateway setup: warn when FCM is chosen (metadata routed via Google's servers)
- README: privacy note + dedicated push section; new docs/playstore-listing.md
  with the FCM/ntfy privacy note for the Play Store listing
- docs: 00/02/03/08/12/16 + setup.md updated to ntfy-default wording
- tests: default-backend assertion updated (86/86 pass)

README.md

@@ -8,6 +8,8 @@ Iris pairs with your running `hermes gateway` over a private WebSocket and gives
 
 - **Native Hermes-Gateway integration** — your hermes → gateway → Iris app
 - **Absolute Privacy!** — everything stays on your own infrastructure
+  (push: ntfy by default; FCM is opt-in and routes push metadata via Google —
+  see [Push notifications](#push-notifications))
 - **No file limit**
 - **No character limit**
 - **Full markdown support** — tables, checkmarks, bold, inline code, code blocks + syntax highlighting…
@@ -36,7 +38,22 @@ hermes-agent ──> hermes gateway ──(WebSocket :8790)──> Iris app (And
 - The app is a first-class hermes *messaging platform*, so everything the gateway
   already does just works: slash commands, cron delivery, `send_message` routing,
   coexistence with Telegram/Discord/etc.
-- Push notifications: FCM (primary) or ntfy (fallback).
+- Push notifications: ntfy (default) or FCM (opt-in).
+
+## Push notifications
+
+Push wakes a backgrounded/offline device; on reconnect the app syncs the
+outbox, so nothing is lost.
+
+- **ntfy (default)** — push metadata stays on your own infrastructure
+  (self-hosted ntfy recommended). This is the backend for truly private
+  communication.
+- **FCM (opt-in, `IRIS_PUSH_BACKEND=fcm`)** — standard/reliable, but FCM push
+  metadata (notification title, device token) is routed through **Google's
+  servers**. If you want truly private communication, use ntfy instead.
+
+Setup: [`docs/setup.md`](docs/setup.md) §4; details:
+[`docs/08-push.md`](docs/08-push.md).
 
 ## Build from source
 
@@ -99,7 +116,7 @@ Notes:
 - Remote access: Tailscale/WireGuard, or a reverse proxy with CA-signed WSS
   (`ANDROID_WS_CERT` / `ANDROID_WS_KEY`).
 
-Full walkthrough, push setup (FCM/ntfy), and troubleshooting:
+Full walkthrough, push setup (ntfy/FCM), and troubleshooting:
 [`docs/setup.md`](docs/setup.md).
 
 ## Contributing