feat(ios): P1-A — server touch-points (lastOutputAt, APNs sender+token endpoint) + APIClient P1 contract

T-iOS-37: LiveSessionInfo.lastOutputAt additive-optional field + manager.list() mapping (+4 tests; web consumers unaffected)
T-iOS-20: src/push/apns.ts — env-gated (all-or-disabled, no crash, zero key-material logging), hand-rolled ES256 JWT
(node:crypto ieee-p1363, zero new deps), NEEDS-INPUT/DONE payloads with structural minimization, token store per
subscription-store conventions, combineNotifyServices parallel to web-push, POST/DELETE /push/apns-token per frozen
wire shape (G-guard, 5/min/IP, 8kb); 65 tests incl. dual-channel e2e vs local fake APNs
T-iOS-38: APIClient builders — apns-token (client-side hex mirror, pre-network reject), projects/detail (lossy decode,
single-point percent-encoding), prefs (unknown-key byte-exact round-trip preservation), public four-tier HostNetworkTier
Coordination: webterminal:// CFBundleURLTypes pre-registered in project.yml for T-iOS-22
Verified: root 1470 tests + tsc clean; APIClient 76 tests, 95.26% coverage; wire-shape cross-check zero mismatches

src/session/manager.ts

@@ -62,6 +62,8 @@ function sendIfOpen(ws: WebSocketLike | null, msg: Parameters<typeof serialize>[
  * (add, delete) rather than in-place modification of the table structure.
  * Individual Session objects do carry mutable fields (attachedWs, detachedAt,
  * lastOutputAt, exitedAt, exitCode) by design — those are runtime handles.
+ * lastOutputAt is no longer list()-omitted: since T-iOS-37 it is serialized
+ * into LiveSessionInfo (unread watermark for /live-sessions consumers).
  *
  * `notifyService` is injected (DI, M5) so the manager never imports push-service
  * directly (avoids a manager↔push-service cycle). sweepStuck uses it to push the
@@ -190,6 +192,7 @@ export function createSessionManager(
         cols: s.pty.cols,
         rows: s.pty.rows,
         telemetry: s.telemetry, // B2: latest telemetry for the thumbnail wall
+        lastOutputAt: s.lastOutputAt, // T-iOS-37: unread watermark (M3 record)
       }))
       .sort((a, b) => b.createdAt - a.createdAt);
   }