Retire one device push token

Runs push.unregister. Called when the customer withdraws notification permission or the token rotates. Public for the same reason registration is — a guest device that registered without a session must be able to retire itself. Takes either an APNs or an FCM token; the row is found by the token alone, so the caller does not repeat its platform.