Add iOS node push-token registration foundation

docs/api/PROTOCOL.md

@@ -667,6 +667,25 @@ Publish companion/node runtime status metadata (for example macOS menu-bar heart
 }
 ```
 
+#### `node.push_token.set`
+
+Register a node push token (currently APNs) for companion delivery routing.
+Requires `server.nodes.push.enabled: true`.
+
+**Request:**
+```json
+{
+  "id": 13,
+  "method": "node.push_token.set",
+  "params": {
+    "provider": "apns",
+    "token": "abcd1234abcd1234abcd1234abcd1234",
+    "topic": "com.example.flynn",
+    "environment": "sandbox"
+  }
+}
+```
+
 #### `system.capabilities`
 
 Return gateway protocol version, node policy status, and feature-gate snapshot.
@@ -688,6 +707,7 @@ Return gateway protocol version, node policy status, and feature-gate snapshot.
     "nodes": {
       "enabled": true,
       "locationEnabled": true,
+      "pushEnabled": true,
       "allowedRoles": ["companion"],
       "registered": true,
       "role": "companion",
@@ -707,6 +727,7 @@ Return the operator-facing snapshot of registered node locations.
 #### `system.nodes`
 
 Return the operator-facing snapshot of registered node connections (identity, role, capabilities, location/status).
+Push tokens are returned as masked previews (`tokenPreview`) and never exposed in full.
 
 ### Canvas Methods