Add native Apple Watch notifications

[lopugit]

Summary

• add a native watchOS companion with secure iPhone pairing, notification inbox, unread state, refresh, and mark-read actions
• bridge the authenticated iPhone session to the watch with WatchConnectivity without copying passwords or browser tokens to the watch
• add protected APNs device registration, session-bound delivery, capability-manifest coverage, and documented Apple/Vercel setup
• embed and validate the watch app in the existing native iOS app

Validation

• XcodeGen project generation
• watchOS Simulator build
• combined iOS Simulator build with embedded-watch validation
• iOS build-for-testing, including shared payload tests compilation
• notification, API capability, and schema tests
• focused lint, diff check, secret scan, and full Vercel production build/output verification

Activation note

Real-device delivery needs Apple App IDs/provisioning with Push Notifications enabled for both bundle IDs plus APNS_KEY_ID, APNS_TEAM_ID, and APNS_PRIVATE_KEY in the deployment environment. Those external credentials and paired-device delivery were not exercised in this branch.