fpush-apns: add APNs token-based authentication (p8)

[infobug]

Summary

• Adds support for token-based APNs authentication (p8 keys) as an alternative to certificate-based auth (p12)
• Token-based auth uses a .p8 key file that never expires, eliminating annual certificate renewal
• Fully backward compatible — existing p12 configs continue to work without any changes

Configuration

Either auth method can be used by providing the appropriate fields:

Certificate-based (existing, unchanged):

"apns": {
  "certFilePath": "/path/to/cert.p12",
  "certPassword": "password",
  "topic": "com.example.app",
  "environment": "production"
}

Token-based (new):

"apns": {
  "keyPath": "/path/to/AuthKey_XXXXXXXXXX.p8",
  "keyId": "XXXXXXXXXX",
  "teamId": "XXXXXXXXXX",
  "topic": "com.example.app",
  "environment": "production"
}

Implementation

• config.rs: Made certFilePath/certPassword optional, added keyPath/keyId/teamId fields, added ApnsAuth enum to express the two auth modes
• push.rs: Added a second init path using Client::token() from the existing a2 crate (which already supports token auth), with clear error messaging if neither auth method is configured

Test plan

• Verify existing p12 config still works unchanged
• Verify p8 config successfully authenticates with APNs and delivers notifications
• Verify startup error is shown if neither cert nor token fields are provided