feat(push): make gateway origin configurable (#7261)

Make the push gateway origin configurable across the relay, gateway,
mobile client, and deployment chart.

This is a fresh deployment. The gateway has only run on personal
development infrastructure, and push has no existing enabled users.
Legacy migration, configured-to-unconfigured mobile transitions, and
rolling upgrades from pre-launch gateway binaries are not supported.

Populated pre-launch databases are rejected with an informative error
before migrations run; their data is untouched. Mobile builds may omit
the gateway URL, leaving push unavailable. Once push is enabled,
subsequent builds must retain that configuration.

### Validation

- All applicable CI checks pass at
`5f546cfaf403f0386f146d213adfb4392f4ec29c`, including Rust,
mobile/Swift, desktop/integration, security, image builds, and Helm
checks. An unrelated agent cancellation test passed on retry.
- PostgreSQL CI passed 384 tests, including the production-entry-point
regression for refusing populated pre-launch databases before
migrations, fresh initialization, and subsequent initialized
deployments.
- Focused local validation passed all 10 gateway PostgreSQL tests under
the CI discovery filter and all 3 unconfigured-mobile tests.
Repository-wide PostgreSQL discovery validation and the complete
pre-push hooks passed.
- Physical-device APNs/App Attest behavior and deployment to a live
cluster were not verified in this work.

---------

Signed-off-by: Tom Brow <tomb@block.xyz>
Co-authored-by: Codex <noreply@openai.com>

scripts/test-mobile-gateway-recipes.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# Exercise the production recipes with macOS's system Bash, not a rewritten copy.
+set -euo pipefail
+repo_root=$(cd "$(dirname "$0")/.." && pwd)
+fixture=$(mktemp -d)
+trap 'rm -rf "$fixture"' EXIT
+mkdir -p "$fixture/bin" "$fixture/scripts" "$fixture/mobile/ios/Flutter"
+for recipe in mobile-dev mobile-build-android; do
+  # Render with the real task runner before installing stubs: a Hermit just
+  # shim can otherwise prepend the real Flutter to PATH ahead of our stub.
+  just --justfile "$repo_root/Justfile" --dry-run "$recipe" > "$fixture/$recipe" 2>&1
+done
+cat > "$fixture/bin/flutter" <<'STUB'
+#!/bin/bash
+set -eu
+printf '%s\n' "$@" > "$CALL_LOG"
+STUB
+cat > "$fixture/bin/pgrep" <<'STUB'
+#!/bin/bash
+exit 0
+STUB
+cat > "$fixture/scripts/mobile-worktree-overrides.sh" <<'STUB'
+#!/bin/bash
+exit 0
+STUB
+chmod +x "$fixture/bin/flutter" "$fixture/bin/pgrep" "$fixture/scripts/mobile-worktree-overrides.sh"
+export PATH="$fixture/bin:$PATH"
+export CALL_LOG="$fixture/arguments"
+unset BUZZ_PUSH_GATEWAY_URL
+
+for recipe in mobile-dev mobile-build-android; do
+  for mode in omitted supplied; do
+    unset BUZZ_PUSH_GATEWAY_URL
+    if [[ "$mode" == supplied ]]; then
+      # A space catches accidental splitting. The build gate validates URLs;
+      # this test checks exact argument forwarding.
+      export BUZZ_PUSH_GATEWAY_URL='https://push.example/value with space'
+    fi
+    (cd "$fixture" && /bin/bash "$fixture/$recipe")
+    if [[ "$recipe" == mobile-dev ]]; then
+      printf '%s\n' run > "$fixture/expected"
+    else
+      printf '%s\n' build apk --debug --no-pub > "$fixture/expected"
+    fi
+    if [[ "$mode" == supplied ]]; then
+      printf '%s\n' "--dart-define=BUZZ_PUSH_GATEWAY_URL=$BUZZ_PUSH_GATEWAY_URL" >> "$fixture/expected"
+    fi
+    diff -u "$fixture/expected" "$CALL_LOG"
+    printf 'PASS %s %s\n' "$recipe" "$mode"
+  done
+done
+
+unset BUZZ_PUSH_GATEWAY_URL
+printf '%s\n' 'BUZZ_PUSH_GATEWAY_URL = https:/$()/push.example' > "$fixture/mobile/ios/Flutter/AppOverrides.xcconfig"
+(cd "$fixture" && /bin/bash "$fixture/mobile-dev")
+printf '%s\n' run '--dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example' > "$fixture/expected"
+diff -u "$fixture/expected" "$CALL_LOG"
+printf 'PASS mobile-dev Xcode override\n'