feat: track push permission denials

[raulriera]

Summary

Adds analytics for users disabling push notifications via Settings. Hooks into the existing on-foreground permission refresh, diffs against a persisted last-known status, and emits a Push Permission Denied event with the previous state attached when the user transitions into denied. Silent on first observation per install so existing users whose push is already off do not fire spurious events when this update ships. Read-only — no permission prompt is ever triggered.

Test plan

• Cold launch on a fresh install does not emit any analytics event.
• Disable push in Settings, return to the app, and confirm one denial event fires with the previous state.
• Re-enable push in Settings and return — no event fires.
• Background and foreground the app without changing push settings — no event fires.