Validate APNS key ID against deployed .p8 key file at startup

[mithileshchellappan]

Problem

Pushboy can boot with APNS_KEY_ID pointing at a key ID whose keys/AuthKey_<APNS_KEY_ID>.p8 file is missing or mismatched. In production this left Pushboy healthy at /v1/ping and FCM-enabled, but without an APNS dispatcher. Regular APNS notifications then failed with Unknown dispatcher platform: apns, and Live Activity APNS start/update sends failed while FCM continued working.

Expected Behavior

Startup should fail fast or emit a high-severity, unmistakable readiness failure when APNS is configured but unusable. Ideally it should also validate that the configured key id matches the deployed key file path/name, or require an explicit APNS_KEY_PATH and verify it is readable before serving traffic.

Suggested Checks

• If APNS_KEY_ID is set and APNS_KEY_PATH is unset, require keys/AuthKey_<APNS_KEY_ID>.p8 to exist and be readable.
• If APNS_KEY_PATH is set, verify the file exists and is readable.
• Include APNS dispatcher readiness in health/readiness output or startup validation so deployment can block bad config.
• Add a test for configured APNS key id plus missing key file.

Incident Evidence

A deployment had APNS_KEY_ID=UA7NLFPNM5, while the only deployed key file was keys/AuthKey_52Q5U5B8JV.p8. Pushboy started and served traffic, but APNS dispatch was absent.