feat: push relay URL gating via pairing response

- PairingService: add pushRelayUrl to LocalPairingResponse and
  CloudflarePairingResponse; propagate through toConnectionConfig()
- ConnectionConfig: add pushRelayUrl field (Codable, Keychain-persisted)
- TransportCredentials: add pushRelayUrl for multi-transport reconnects
- AgentManager: save/restore pushRelayUrl in TransportCredentials;
  pass it when rebuilding ConnectionConfig in connectAgent()
- ACPClientWrapper: guard registerPushToken() with pushRelayUrl != nil
  so push registration is skipped when the bridge has no relay configured

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: saltukalakus

Aptove/Models/ConnectionConfig.swift

@@ -12,6 +12,10 @@ struct ConnectionConfig: Codable {
     let cwd: String
     /// Stable bridge agent UUID used for multi-transport deduplication (present in static JSON QR codes).
     let agentId: String?
+    /// Push relay URL from the bridge's pairing response.
+    /// Non-nil only when the bridge has push fully configured.
+    /// Mobile clients use this as the gate for registering push tokens.
+    let pushRelayUrl: String?
 
     enum CodingKeys: String, CodingKey {
         case url
@@ -23,9 +27,10 @@ struct ConnectionConfig: Codable {
         case version
         case cwd
         case agentId
+        case pushRelayUrl
     }
 
-    init(url: String, clientId: String? = nil, clientSecret: String? = nil, authToken: String? = nil, certFingerprint: String? = nil, protocolVersion: String = "acp", version: String = "1.0.0", cwd: String, agentId: String? = nil) {
+    init(url: String, clientId: String? = nil, clientSecret: String? = nil, authToken: String? = nil, certFingerprint: String? = nil, protocolVersion: String = "acp", version: String = "1.0.0", cwd: String, agentId: String? = nil, pushRelayUrl: String? = nil) {
         self.url = url
         self.clientId = clientId
         self.clientSecret = clientSecret
@@ -35,6 +40,7 @@ struct ConnectionConfig: Codable {
         self.version = version
         self.cwd = cwd
         self.agentId = agentId
+        self.pushRelayUrl = pushRelayUrl
     }
 
     func validate() throws {

Aptove/Models/TransportCredentials.swift

@@ -7,6 +7,8 @@ struct TransportCredentials: Codable {
     let certFingerprint: String?
     let clientId: String?
     let clientSecret: String?
+    /// Push relay URL from the bridge's pairing response (same for all endpoints of a bridge).
+    let pushRelayUrl: String?
 }
 
 // MARK: - Keychain Storage

Aptove/Services/ACPClientWrapper.swift

@@ -458,10 +458,16 @@ class ACPClientWrapper: ObservableObject {
         print("✅ Session conversation cleared, workspace retained")
     }
 
-    /// Register the APNs push token with the bridge for background notifications
+    /// Register the APNs push token with the bridge for background notifications.
+    /// Skipped when the bridge has no push relay configured (pushRelayUrl is nil).
     func registerPushToken() async {
+        guard config.pushRelayUrl != nil else {
+            print("📲 ACPClientWrapper: Bridge has no push relay configured, skipping registration")
+            return
+        }
+
         let pushManager = PushNotificationManager.shared
-        
+
         guard let deviceToken = await pushManager.getDeviceToken() else {
             print("📲 ACPClientWrapper: No push token available, skipping registration")
             return

Aptove/Services/AgentManager.swift

@@ -184,7 +184,8 @@ class AgentManager: ObservableObject {
             authToken: config.authToken,
             certFingerprint: config.certFingerprint,
             clientId: config.clientId,
-            clientSecret: config.clientSecret
+            clientSecret: config.clientSecret,
+            pushRelayUrl: config.pushRelayUrl
         )
         try TransportCredentialManager.save(credentials, for: endpoint.endpointId ?? UUID().uuidString)
 
@@ -381,7 +382,8 @@ class AgentManager: ObservableObject {
                 clientSecret: credentials?.clientSecret,
                 authToken: credentials?.authToken,
                 certFingerprint: credentials?.certFingerprint,
-                cwd: entity.cwd
+                cwd: entity.cwd,
+                pushRelayUrl: credentials?.pushRelayUrl
             )
 
             // Swap client for this endpoint's config

Aptove/Services/PairingService.swift

@@ -111,6 +111,7 @@ struct LocalPairingResponse: Codable {
     let certFingerprint: String?
     let agentId: String?
     let cwd: String
+    let pushRelayUrl: String?
 }
 
 /// Response from /pair/cloudflare endpoint (future)
@@ -123,6 +124,7 @@ struct CloudflarePairingResponse: Codable {
     let clientSecret: String
     let agentId: String?
     let cwd: String
+    let pushRelayUrl: String?
 }
 
 /// Generic pairing response that can hold either type
@@ -150,7 +152,8 @@ enum PairingResponse {
                 certFingerprint: response.certFingerprint,
                 protocolVersion: response.protocol,
                 version: response.version,
-                cwd: response.cwd
+                cwd: response.cwd,
+                pushRelayUrl: response.pushRelayUrl
             )
         case .cloudflare(let response):
             return ConnectionConfig(
@@ -161,7 +164,8 @@ enum PairingResponse {
                 certFingerprint: nil,
                 protocolVersion: response.protocol,
                 version: response.version,
-                cwd: response.cwd
+                cwd: response.cwd,
+                pushRelayUrl: response.pushRelayUrl
             )
         }
     }