[codex] Improve CLI coverage, tests, and backend support

[kiliantyler]

What changed

This PR substantially expands and hardens the Cowtail CLI.

It refactors the CLI command tree into per-group modules, adds a built-in updater, and expands the command surface with alert/fix read operations, health output, user/device inspection, and config diagnostics. It also adds a Bun-based CLI test harness and repo-wide oxlint / oxfmt coverage for TypeScript.

On the backend side, it adds the HTTP support those CLI commands need and switches iOS push registration to verify Apple identity tokens server-side before deriving the stored userId.

Why

The CLI had reached the point where ad hoc command wiring and manual help output were getting in the way. This makes it more maintainable, more testable, and much closer to a real operational tool instead of a thin write helper.

Impact

• clearer CLI structure and help behavior
• more complete alert/fix workflows from the terminal
• built-in self-update behavior for installed binaries
• config validation / doctor workflows
• TypeScript linting and formatting enforcement at the repo root
• safer iOS push registration through backend token verification

Validation

• cd cli && bun run check
• cd cli && bun test
• cd protocol && bun run check
• cd web && bun run build
• bun run lint:ts
• bun run fmt:ts:check