M2: backend Worker (space weather, aurora alerts) !8

Stacked on !7 (targets m2-sun).

• server/: Worker + D1. Cron (5 min) polls SWPC, snapshots it, and sends aurora pushes: bands reached by the oval (NOAA Kp-to-latitude, 6° horizon margin), 20:00–04:00 local, once per band per 12 h; 410 tokens deleted.
• API: GET /v1/today, POST/DELETE /v1/devices, GET /healthz. Devices send a 5° geomagnetic band and UTC offset only.
• APNs sender copied from the spike.
• PLAN.org: M2 status, simplifications against the design (no Queue, clock-based night, no rate limiting yet).

Tests: node --test test/ (8 pass). Smoke-tested under wrangler dev --test-scheduled with local D1: register, invalid register rejected, cron fetched live SWPC, /v1/today served Kp 0.33, delete. Not deployed.