Admin-only: device token coverage across active users.

Tells us how many users can actually receive push notifications. This is the single metric that determines whether the notification pipeline reaches real devices — a large users_without_token value means the iOS permission flow needs attention.