chore: release engine 0.37.0

[mattyhogan]

Summary

• bump the engine crate and lockfile from 0.36.0 to 0.37.0
• establish the reviewed release version required by lux-swift 1.1.0

Included engine changes

• fix(auth): bind native OAuth codes with PKCE #74: native OAuth authorization-code PKCE binding
• fix(push): make device cleanup race-safe #75: user-scoped raw-token push device cleanup for rotation and sign-out races

Validation

• cargo check --locked
• cargo test --locked --lib --quiet (650 passed)
• the complete code changes are independently green in fix(auth): bind native OAuth codes with PKCE #74 and fix(push): make device cleanup race-safe #75

Release procedure

After #74 and #75 merge, retarget this PR to main, merge it, and tag the resulting reviewed commit as v0.37.0. The existing tag workflows publish release binaries and the multi-architecture GHCR image.