Default push backend to ntfy; FCM opt-in with privacy warning (issue #10)

- IRIS_PUSH_BACKEND now defaults to ntfy (keeps push metadata on your own
  infrastructure); FCM is opt-in via IRIS_PUSH_BACKEND=fcm
- build_push_backend(): ntfy for empty/unknown names, FCM only on explicit 'fcm'
- gateway setup: warn when FCM is chosen (metadata routed via Google's servers)
- README: privacy note + dedicated push section; new docs/playstore-listing.md
  with the FCM/ntfy privacy note for the Play Store listing
- docs: 00/02/03/08/12/16 + setup.md updated to ntfy-default wording
- tests: default-backend assertion updated (86/86 pass)

gateway-plugin/push.py

@@ -1,4 +1,4 @@
-"""Push backends: FCM (primary) + ntfy (fallback).
+"""Push backends: ntfy (default) + FCM (optional).
 
 ``PushBackend`` interface with two implementations:
   - ``FcmBackend``: FCM HTTP v1 via ``httpx`` + a Firebase service account
@@ -8,7 +8,7 @@
     (default ``https://ntfy.sh``) via ``httpx``; the app's listener
     subscribes to the topic.
 
-Selected by ``IRIS_PUSH_BACKEND`` (``fcm`` default, ``ntfy`` fallback).
+Selected by ``IRIS_PUSH_BACKEND`` (``ntfy`` default, ``fcm`` optional).
 Fired when a frame has no live subscriber; the data payload drives a silent
 sync on the device (docs/08-push.md).
 
@@ -33,7 +33,9 @@ import httpx
 logger = logging.getLogger(__name__)
 
 FCM_SCOPE = "https://www.googleapis.com/auth/firebase.messaging"
-FCM_TOKEN_URL = "https://oauth2.googleapis.com/token"
+# Not a secret: the well-known Google OAuth2 token endpoint.
+# pi-lens-ignore: S105
+FCM_TOKEN_URL = "https://oauth2.googleapis.com/token"  # noqa: S105
 FCM_V1_SEND_URL = "https://fcm.googleapis.com/v1/projects/{project_id}/messages:send"
 FCM_LEGACY_SEND_URL = "https://fcm.googleapis.com/fcm/send"
 # Refresh the cached access token this long before its expiry.
@@ -54,7 +56,7 @@ class PushBackend:
     name: str = "push"
     # DeviceRegistry column that carries this backend's target token.
     # Not a secret: a DB column name (string literal), not a credential.
-    # pi-lens-ignore: python-hardcoded-secrets
+    # pi-lens-ignore: S105, python-hardcoded-secrets
     token_field: str = ""
 
     def configured(self) -> bool:
@@ -87,8 +89,8 @@ class FcmBackend(PushBackend):
 
     name = "fcm"
     # Not a secret: a DB column name (string literal), not a credential.
-    # pi-lens-ignore: python-hardcoded-secrets
-    token_field = "fcm_token"
+    # pi-lens-ignore: S105
+    token_field = "fcm_token"  # noqa: S105
 
     def __init__(
         self,
@@ -257,8 +259,8 @@ class NtfyBackend(PushBackend):
 
     name = "ntfy"
     # Not a secret: a DB column name (string literal), not a credential.
-    # pi-lens-ignore: python-hardcoded-secrets
-    token_field = "ntfy_topic"
+    # pi-lens-ignore: S105
+    token_field = "ntfy_topic"  # noqa: S105
 
     def __init__(
         self,
@@ -332,9 +334,14 @@ def build_push_backend(
     ntfy_server_url: str | None = None,
     ntfy_auth_token: str | None = None,
 ) -> PushBackend:
-    """Select the backend by name (``IRIS_PUSH_BACKEND``; fcm default)."""
-    if (name or "").strip().lower() == "ntfy":
-        return NtfyBackend(
-            topic=ntfy_topic, server_url=ntfy_server_url, auth_token=ntfy_auth_token
-        )
-    return FcmBackend(service_account=fcm_service_account, server_key=fcm_server_key)
+    """Select the backend by name (``IRIS_PUSH_BACKEND``; ntfy default).
+
+    ntfy is the default: it keeps push metadata on your own infrastructure.
+    FCM is opt-in (``IRIS_PUSH_BACKEND=fcm``) — its metadata (title, device
+    token) is routed through Google's servers.
+    """
+    if (name or "").strip().lower() == "fcm":
+        return FcmBackend(service_account=fcm_service_account, server_key=fcm_server_key)
+    return NtfyBackend(
+        topic=ntfy_topic, server_url=ntfy_server_url, auth_token=ntfy_auth_token
+    )