PushGate v1.0.2

Security fixes, with all authentication modes retained:

• S1: upgrade certifi to 2026.10.19 in server and PAM locks.
• S2: require X-PushGate-CSRF: 1 for proxy-authenticated admin writes; the admin UI supplies it.
• F3: revoke push-derived trusted sessions when their approving device is revoked, including before consumption.

Also repairs web/Android CI setup and aligns release metadata at 1.0.2.