For the rebuilt native app (root/el3ab-mobile):
- api/auth.php id_token: sign in with a Google or Apple ID token from the
  phone (GoTrue grant_type=id_token), instead of a web redirect Google
  refuses inside a WebView.
- Push through FCM HTTP v1 (includes/push.php): every notifications row is
  queued in push_outbox by a trigger, whoever wrote it (this app, the
  manager, SQL functions), and sent to the player's phones; challenges and
  chat messages queue a push of their own. Sent right after the request
  that made them (a fire-and-forget call to api/push.php dispatch) and by
  the scheduler every minute; dead tokens are dropped. api/push.php keeps
  the phones (register / unregister) and sends a test for the manager.
  The Firebase service account lives in platform_secrets (service only),
  set from the manager.
- The web bridge reports every refreshed session to the shell, asks for the
  native sign-in when the login screen opens inside the app, routes tapped
  pushes (tournament, chat, challenge), and answers the back button. The
  CSS that hid the web tab bar for a native bar is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>