feat(push): gate Live Activity push behind a feature flag, off by default

[RonenMars]

Live Activity push came up whenever APNS_KEY was set, which made a credential the only switch.
That is the wrong switch: the surface also needs a registered push-to-start token, and without one tb-mobile falls back to starting the activity locally — where it only updates while the app is foregrounded, freezes on backgrounding, and expires silently at iOS's ~8h cap.

initLiveActivityPush() now checks the new liveActivityPush feature flag before it reads the environment, so a box with a valid p8 stays off until someone asks for it.
Default off, env THREADBASE_FEATURE_LIVE_ACTIVITY_PUSH, same registry and precedence as the existing flags.

The early return logs at live_activity.disabled and names the flag.
This box previously printed "Live Activity push enabled" at exactly that point, so an ignored credential must not look like a missing one.

Both halves, one switch

tb-mobile reads this flag over GET /api/config/feature-flags and skips its own local ActivityKit path — and the Android ongoing-notification equivalent — when it is off.
That side ships in RonenMars/tb-mobile as a separate PR on the same branch name; this PR alone only stops the server pushing.

Verified state

npm run lint clean (tsc + biome).
__tests__/live-activity-flag.test.ts passes 3/3, and I confirmed the gate is load-bearing by neutering it and watching the off-case go red before restoring it.
The test carries a positive control: with the flag on and the same fake credentials, live_activity.enabled fires; with it off, only live_activity.disabled does.

Full suite: 1918 passed, 19 failed.
All 19 failures are timeouts (4 test, 3 hook, the rest cascading) across cors-middleware, pair-endpoints, security-hardening and webhook-update, with zero assertion failures.
The same four files fail on origin/main with a different random subset (8 failed / 27 passed), so this is pre-existing flakiness under host load rather than a regression from this branch.