Deploy divine-push-service to GKE production

[dcadenas]

Goal

Get divine-push-service running in GKE, starting with poc/staging, then production.

Prerequisites

• divinevideo/divine-iac-coreconfig#364 must be merged first (Firebase env vars + namespace fix)

Tasks

1. Verify Terraform has been applied

Confirm that terragrunt apply has been run for all environments (poc, staging, production):

• GCP service accounts exist (divine-push-{env}@{project}.iam.gserviceaccount.com)
• Secret Manager secrets exist (divine-push-service-nostr-key-{env})
• Cross-project FCM IAM binding is active on openvine-co

2. Deploy to poc and verify

• Trigger CI to build and push image to poc Artifact Registry
• Verify the service starts, connects to relay, and can send test notifications
• Check health endpoint responds

3. Deploy to staging and verify

Same verification as poc.

4. Deploy to production

• Merge production image deploy PR in IAC repo
• Monitor logs and health

Already done

• Upload APNs auth key in Firebase console — APNs certificates already configured in openvine-co (valid until March 2027)
• CI rewrite + ADC support (PR Rewrite CI for build-once pattern and add ADC support #2 merged)
• IAC CI/CD workflow support (divine-iac-coreconfig#313 merged)