Default push backend to ntfy; FCM opt-in with privacy warning (issue #10)

- IRIS_PUSH_BACKEND now defaults to ntfy (keeps push metadata on your own
  infrastructure); FCM is opt-in via IRIS_PUSH_BACKEND=fcm
- build_push_backend(): ntfy for empty/unknown names, FCM only on explicit 'fcm'
- gateway setup: warn when FCM is chosen (metadata routed via Google's servers)
- README: privacy note + dedicated push section; new docs/playstore-listing.md
  with the FCM/ntfy privacy note for the Play Store listing
- docs: 00/02/03/08/12/16 + setup.md updated to ntfy-default wording
- tests: default-backend assertion updated (86/86 pass)

gateway-plugin/adapter.py

@@ -33,8 +33,8 @@ register the (delivery-validated) file in the media registry and emit
 ``validate_media_delivery_path`` at pull time.
 
 Milestone M5: push + offline. Frames with no live subscriber are parked in
-the outbox (M3) AND wake the device via the push backend (``push.py``: FCM
-HTTP v1 primary, ntfy fallback, selected by ``IRIS_PUSH_BACKEND``).
+the outbox (M3) AND wake the device via the push backend (``push.py``: ntfy
+default, FCM HTTP v1 as an option, selected by ``IRIS_PUSH_BACKEND``).
 ``notification`` frames render in-app banners and mirror to push (channel
 events, cron deliveries, approvals, clarifies); high-priority kinds push even
 when a device is live. ``fcm.register`` rotates push tokens (registry + live
@@ -526,7 +526,7 @@ DEFAULT_PORT = 8790
 DEFAULT_HTTP_PORT = 8791  # docs/19: HTTP fallback leg
 DEFAULT_HOME_CHANNEL = "default"
 DEFAULT_HOME_CHANNEL_NAME = "Default"
-DEFAULT_PUSH_BACKEND = "fcm"
+DEFAULT_PUSH_BACKEND = "ntfy"
 DEFAULT_OUTBOX_RETENTION_HOURS = 72
 DEFAULT_MAX_UPLOAD_BYTES = 100 * 1024 * 1024  # 100 MB
 
@@ -1201,10 +1201,17 @@ def interactive_setup() -> None:
     )
     save_env_value("IRIS_HTTP_PORT", str(_parse_port(port)))
     backend = prompt(
-        "Push backend (fcm/ntfy)",
+        "Push backend (ntfy/fcm)",
         default=get_env_value("IRIS_PUSH_BACKEND") or DEFAULT_PUSH_BACKEND,
     )
-    save_env_value("IRIS_PUSH_BACKEND", (backend or DEFAULT_PUSH_BACKEND).strip().lower())
+    backend = (backend or DEFAULT_PUSH_BACKEND).strip().lower()
+    save_env_value("IRIS_PUSH_BACKEND", backend)
+    if backend == "fcm":
+        print_warning(
+            "FCM push metadata (notification title, device token) is routed "
+            "through Google's servers. For truly private communication use "
+            "ntfy (self-hosted) instead."
+        )
 
     # Pairing payload for the app's Connect screen (manual entry + QR scan).
     # Advertise a routable host: a bind wildcard (0.0.0.0/127.0.0.1) is
@@ -1346,7 +1353,7 @@ class IrisAdapter(BasePlatformAdapter):
         # /fast): picker_id -> pending state. In-memory only — a gateway
         # restart expires them (a stale picker.select is a no-op).
         self._pending_pickers: dict[str, dict] = {}
-        # M5: push backend (FCM primary, ntfy fallback) + the throttle for
+        # M5: push backend (ntfy default, FCM optional) + the throttle for
         # the outbox-prune banner.
         self._push: PushBackend = build_push_backend(
             self.push_backend,