Apply Push Token Mapping

How to read (<match_key>, push_token) tuples from the source DB.

Exactly one of email_column or external_id_column is required; the validator rejects configs that set both or neither. The chosen column is the match key — the runner projects it from the token table (flat layout) or via embedded select on the identity table (joined layout). external_id_column matches against Contact.external_id and uses the unique index uq__contacts__org_external_source for ~10-50ms/chunk lookup — the preferred path for sources whose contact-ingestion keys on a stable user_id (e.g. Supabase users.id). email_column matches against Contact.email and exists for sources that don't propagate a stable identity column.