Add secure iOS and Android gateway clients

[gitcommit90]

Summary

• add thin Capacitor iPhone/iPad and Android clients that connect to an already configured HTTPS 1Helm host
• keep passwords ephemeral and sessions in native Keychain/Keystore-backed storage
• add a permanent-certificate, directly distributed universal Android APK path and an App Store iOS archive/export path
• add strict mobile-origin CORS, packaged local UI, native assets, tests, docs, and release gates

Acceptance ledger

1. Thin gateway only: the native app asks for server address, username, and password; it never initializes or exposes first-run setup for the remote host.
2. Apple support: an iPhone/iPad Capacitor target, stable bundle ID, privacy declarations, deep link callback, and App Store archive/export automation are versioned.
3. Direct Android distribution: release automation builds a signed universal APK without Google Play, fails closed without retained external signing material, and pins the permanent release-certificate fingerprint.
4. Credential handling: the password is cleared immediately after submission and is never retained; the session lives in device-only iOS Keychain or Android Keystore-backed encrypted storage.
5. Remote web parity: REST, WebSocket, files, media, avatars, photos, OAuth, and external-link handling route through the chosen HTTPS host while the audited local UI and bundled assets remain packaged.
6. Compatibility and security: the server exposes an explicit versioned mobile handshake and CORS only for packaged Capacitor origins; cleartext, Android backups, native debugging, and release logging are disabled.
7. Release identity: version 0.0.13 and its channel-machine pins, changelog, docs, native versions, and mobile release checklist are synchronized.

Verification

• npm run typecheck
• npm run build
• npm test — 117 native-world + 100 passed, one existing environment-only Chrome skip
• npm run test:onboarding-browser — 20/20
• ANDROID_SDK_ROOT=/opt/android-sdk npm run mobile:check — 4/4 mobile + Capacitor doctor clean
• Android release: Gradle lint/R8/resource shrink, zipalign, v2/v3 signature, application ID/version, and permanent certificate verified
• git diff --check

Platform handoff

The iOS project and archive/export automation are ready, but the retained Apple build host currently has Command Line Tools only—no full Xcode, Apple Development/Distribution identity, or provisioning profile. Those external prerequisites are intentionally not bypassed.