fix(auth): harden refresh ownership and scheduler after auth migration

Restore /health to { ok: true }. Scope refresh to owned devices via
deviceId/fcmToken, improve register upsert logging, skip legacy rows in
the scheduler with per-token dedupe, and prefer non-legacy rows for push.

src/scheduler.ts

@@ -1,5 +1,6 @@
 import { db } from "./db/fcmTokens.js";
 import { sendPushToDevice } from "./services/pushService.js";
+import { maskToken } from "./util/maskToken.js";
 
 let intervalId: ReturnType<typeof setInterval> | undefined;
 
@@ -9,8 +10,19 @@ export function startScheduler(): void {
   intervalId = setInterval(async () => {
     try {
       console.log("[Scheduler] Checking devices...");
-      const devices = await db.getAll();
+      const devices = await db.getAllForScheduler();
+      const seenTokens = new Set<string>();
+
       for (const d of devices) {
+        if (seenTokens.has(d.fcmToken)) {
+          console.log(
+            "[Scheduler] Duplicate device skipped:",
+            d.deviceId,
+            maskToken(d.fcmToken)
+          );
+          continue;
+        }
+        seenTokens.add(d.fcmToken);
         await sendPushToDevice(d.fcmToken);
       }
     } catch (err) {