IAP Backend

Auth token exchange (Apple/Google) → JWT + IAP + Notifications v2.