feat: add HomeSec iOS app shell MVP

[lan17]

Summary

• add the iOS app design doc for the M1 Capacitor shell direction
• add runtime-configurable API base URL/token provider abstractions and native setup flow
• add the Capacitor iOS scaffold rooted in ui/ with LAN HTTP, local network, and microphone plist support
• add centralized Capacitor runtime detection helpers for browser vs iOS native mode
• harden native first-launch setup, token/session handling, and local-only plain HTTP behavior after review-loop findings

Notion

Epic: HomeSec iOS/iPad app

Implemented tickets:

• iOS-00 — Add finalized iOS design doc to repo
• iOS-01 — Introduce API environment and token-provider abstraction
• iOS-02 — Make API client base URL runtime-configurable
• iOS-03 — Add native-mode setup screen for server URL and API token
• iOS-04 — Add Capacitor iOS scaffold rooted in ui/
• iOS-05 — Add iOS native runtime detection

Review loop

• fixed native first launch so iOS redirects to /native-setup before shell API queries when server/auth session state is missing
• moved native token handling to an in-memory runtime provider, with auth-disabled readiness tracked via a non-secret marker
• restricted plain HTTP setup URLs to local/private hosts and removed arbitrary WebView cleartext loads from ATS
• preserved deep-link return intent after setup and cleared React Query cache when switching HomeSec servers
• final fresh review pass returned no remaining code findings; unrelated graphify-out wiki edits remain unstaged locally

Validation

• make check with Node 22.22.0 and TEST_DB_DSN=postgresql://homesec:homesec@localhost:55432/homesec
• backend lint/typecheck clean
• 1384 backend tests passed
• UI API check/lint clean
• 68 UI test files / 332 tests passed
• UI typecheck/build passed
• iOS scaffold targeted checks passed: pnpm ios:sync, plutil -lint ui/ios/App/App/Info.plist, pnpm exec cap doctor ios, xcodebuild -list -project ios/App/App.xcodeproj -packageAuthorizationProvider netrc
• GitHub remote checks passed on head 96e30f7: PR title validation and CI

Notes

• Native simulator launch is blocked locally by the installed Xcode/iOS simulator runtime mismatch; project enumeration and Capacitor sync pass.
• The worktree still has unrelated generated wiki edits in graphify-out/wiki/FilterResult.md and graphify-out/wiki/RTSPSource.md; they are intentionally not included.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.16%. Comparing base (0d677d9) to head (96e30f7).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #105   +/-   ##
=======================================
  Coverage   87.16%   87.16%           
=======================================
  Files         151      151           
  Lines       16422    16422           
=======================================
  Hits        14314    14314           
  Misses       2108     2108           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.