Register Push Token

POST /api/v1/device/push-token

Register or update Expo push token for notifications. Supports both authenticated users and anonymous devices.

Idempotent: an unchanged token skips the write entirely. Clients re-POST the same token on every app open, and a misbehaving one can hammer this route (69,732 POSTs from a single 2.0.40 device on 2026-07-22; 25,451 from a 2.0.41 device on 2026-08-03 — 99.2% of ALL app errors that month). Repeated UPDATEs of one row serialize on its lock, so the pileup turns a 5ms write into client-side timeouts — which then defeat the client's own post-once-on-success guard and keep it retrying. Not writing is the brake; the per-device rate limit (LNK-AUDITAPI) is the circuit breaker: a normal client POSTs once per app open, a looping one gets 429s that its backoff (2.0.45+) treats as a hard stop for the session.