How can I create a Journey that sends a push notification, with a fallback to an in-app message for users who have pushes disabled?

You can build a push-first flow with an in-app fallback using the Reachability check flow-control element in Customer Journey.

Entry element — start the Journey with a trigger-based, audience-based or API-based entry.
Add a "Reachability check" element from the Flow section of the left panel, double-click it, and under Add a channel add Push Notifications. Pick the platforms to check (by default, all platforms).
- Each channel you add becomes its own branch on the canvas, and users who aren't reachable on any listed channel go down the All others branch.
- For Push, a user is reachable when a device is registered on a matching platform and its Push Alerts Enabled tag is true.
- Push branch → add a Push element to send the notification.
- All others branch → add an In-app element as the fallback.
Finish each branch with an "Exit" element so users leave the Journey cleanly.

Entry element
- Reachability check: Push
  - Push → Push element → Exit
  - All others → In-app element → Exit

There is no separate "Filter" element in Customer Journey. If you need to branch on segments or tag values, use the Condition split element.
Under Which devices to check, choose whether the check looks at All devices of the user or Only the device that entered the journey.
Reachability check does not verify push-token validity or the OS-level notification permission; for push it relies on the Push Alerts Enabled tag. A user who has no device at all in the application doesn't go down any branch: they drop out of the Journey with the Device not found reason.
You can add several channels to one Reachability check in priority order (for example Push, then Email, then SMS) to cover more channels; the user follows the first channel they are reachable on.