refactor: migrate pool.query() calls in push_subscriptions to table methods

[moltboie]

Summary

Completes the pool.query() migration started in PR #248 (sessions + spam_allowlists). This PR covers the remaining repository file with direct pool.query() calls.

push_subscriptions.ts (2 pool.query calls removed):

• Convert pushSubscriptionsTable from createTable() to a named PushSubscriptionsTable class
• Add getByUserIds(userIds: string[]) — encapsulates SELECT * WHERE user_id IN (...)
• Add deleteOlderThan(cutoff: string) — encapsulates DELETE WHERE updated < $1
• cleanSubscriptions() now delegates to pushSubscriptionsTable.deleteOlderThan()
• getSubscriptions() now delegates to pushSubscriptionsTable.getByUserIds()
• Direct pool import removed from the repository file

Motivation

Per DEVELOPMENT.md Table Class Methods convention: all DB operations in repository files should go through table class methods. Direct pool.query() calls in repositories are migration debt.

No Behavior Changes

Same SQL queries, same logic. TypeScript compiles cleanly.

Closes #244 (together with PR #248)

[moltboie]

Self-review: pool.query() migration for push_subscriptions.

Pattern consistency:

• Matches the same approach used in PR refactor: migrate pool.query() from sessions and spam_allowlists repositories to table methods #248 (SessionsTable, SpamAllowlistTable named classes)
• createTable() → named class extending Table<> with same abstract fields filled in
• Custom methods added for queries that don't fit generic Table methods

getByUserIds review:

• Uses positional params ($1, $2, ...) built from array length — safe, no SQL injection
• Returns PushSubscriptionModel[] (typed, validated by Model constructor)
• Empty array guard returns early, consistent with base class queryByIds pattern

deleteOlderThan review:

• Parameterized query with single $1 cutoff — safe
• Returns count (rowCount ?? 0) consistent with base class deleteWhere
• Repository caller builds cutoff via new Date(...).toISOString() — unchanged

getSubscriptions cleanup:

• Removed manual row casting (row.user_id as string, etc.) — now uses typed model fields
• row.last_notified is typed as string | null; new Date(null) would be Invalid Date but existing logic was the same (passing through)

TypeScript clean. No behavior changes.

[moltboie]

Self-Review

Discussion thread status:

• New PR. No prior feedback. Continues pool.query() migration from PR refactor: migrate pool.query() from sessions and spam_allowlists repositories to table methods #248.

Checked:

• Migration scope: push_subscriptions.ts — 2 direct pool.query() calls converted to Table class methods. Consistent with DEVELOPMENT.md pattern.
• PushSubscriptionsTable extends Table: Table class handles pool internally — correct abstraction. Repository file now delegates to table instance.
• Logic equivalence: SQL queries unchanged in semantics; just relocated to the correct abstraction layer.
• Export chain: Table instance exported correctly through barrels.
• CI: build + test both passing ✅

E2E Testing:

• Push subscription functionality (subscribe/unsubscribe) should work identically. Refactor-only.

Issues found:

• None

Confidence: High