implemented a guided notification permission flow triggered on the first Talk visit

lib/push/push_registration.dart

@@ -333,10 +333,26 @@ class PushRegistration {
     }
   }
 
+  /// True when the OS notification permission is already granted
+  /// (`authorized`/`provisional`). Read-only — never triggers the OS prompt.
+  /// Used by the cold-start/self-heal path so it registers only for devices
+  /// that already opted in, leaving the actual prompt to the first Talk visit.
+  static Future<bool> isOsPermissionGranted() async {
+    try {
+      final settings = await FirebaseMessaging.instance
+          .getNotificationSettings();
+      return settings.authorizationStatus == AuthorizationStatus.authorized ||
+          settings.authorizationStatus == AuthorizationStatus.provisional;
+    } on Object {
+      return false;
+    }
+  }
+
   /// Registers this device when push is both user-enabled and backend-capable.
-  /// Requests the OS notification permission first (covers iOS + Android 13);
-  /// an explicit denial skips registration entirely so NC/proxy never push to a
-  /// device that cannot display notifications. Safe to call on every start —
+  /// Only registers when the OS notification permission is *already* granted —
+  /// it never triggers the OS prompt itself. Requesting the permission is the
+  /// job of the first Talk visit (see `maybePromptTalkNotifications`), which
+  /// keeps the prompt out of the cold-start path. Safe to call on every start —
   /// Nextcloud dedups an unchanged registration — which also self-heals a
   /// device whose registration was lost.
   static Future<void> syncSubscription({
@@ -344,8 +360,8 @@ class PushRegistration {
     required bool capable,
   }) async {
     if (!(enabled && capable)) return;
-    if (!await requestOsPermission()) {
-      log('Push: OS notification permission denied, skipping registration');
+    if (!await isOsPermissionGranted()) {
+      log('Push: OS notification permission not granted, skipping registration');
       return;
     }
     final registration = PushRegistration();