[refactor](alarm): retire subscribe-token rotation

The subscribe token is minted once per alert and lives as long as it does; subscribers are never evicted, so the rotation counter had no reader. Drop token_version from the schema and stop serialising tokenVersion on the wire. The QR payload is now built from alert id + token only, which also makes it instance-relative.

src/internal/alarmtoken/token.go

@@ -22,7 +22,8 @@
 //     constant-time over the digest.
 //   - the SUBSCRIBE token is 24 random bytes, base64url (32 chars). It is
 //     stored in plaintext on purpose: it is shared through the QR code with
-//     every subscriber, and rotation is a cheap UPDATE (token_version). It is
+//     every subscriber and is minted once per alert — there is no rotation
+//     (subscribers are permanent for the lifetime of the alert). It is
 //     still compared in constant time so a timing oracle cannot be used to
 //     recover it byte by byte.
 package alarmtoken

src/internal/qrpayload/qrpayload.go

@@ -21,7 +21,7 @@
 //
 // The fragment (not the query string) carries the token so the secret is never
 // sent to the host if a scanner ever resolves the URL in a browser. Build is
-// used by createAlert/getAlert/rotateSubscribeToken, and Parse is used by any
+// used by createAlert/getAlert, and Parse is used by any
 // component that accepts a scanned payload (the Android client's scanner and
 // the service's own tests).
 //