ci(ios): internal-testing-only publishing + declare encryption exemption

The IPA now builds, signs, uploads and processes on App Store Connect. Set
submit_to_testflight=false so the build stays green via internal testing; external
beta review (which needs Test Information + a demo login) is opt-in later. Also set
ITSAppUsesNonExemptEncryption=false in Info.plist so ASC stops prompting for export
compliance on every upload.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

codemagic.yaml

@@ -90,7 +90,13 @@ workflows:
     publishing:
       app_store_connect:
         auth: integration
-        submit_to_testflight: true
+        # Upload the build to App Store Connect. It is immediately usable for INTERNAL TestFlight testing
+        # (no Apple review). We keep external-beta submission OFF for now: submit_to_testflight=true would
+        # push the build to EXTERNAL beta review, which requires the Test Information (feedback email +
+        # beta review contact + a demo login, since our app needs sign-in) to be filled in first, and
+        # fails the build until then. Flip to true (and add `beta_groups:` + fill Test Information at
+        # App Store Connect → TestFlight → Test Information) when you want outside testers.
+        submit_to_testflight: false
         # Flip this to true (and add a `submit_to_app_store` group with reviewer notes) once you're ready
         # to push a build to public App Store review instead of only TestFlight.
         # submit_to_app_store: false

mobile/scripts/ios-patch.sh

@@ -21,6 +21,11 @@ set_str NSPhotoLibraryAddUsageDescription   "Biz Connect saves images and record
 # Human-readable display name on the home screen.
 set_str CFBundleDisplayName "Biz Connect"
 
+# We use only standard encryption (HTTPS/TLS), which is exempt — declaring this up front stops App Store
+# Connect from asking the "export compliance" question on every single build/TestFlight upload.
+"$PB" -c "Add :ITSAppUsesNonExemptEncryption bool false" "$PLIST" 2>/dev/null \
+  || "$PB" -c "Set :ITSAppUsesNonExemptEncryption false" "$PLIST"
+
 # Allow the webview to load our HTTPS origin (we do NOT enable arbitrary cleartext).
 "$PB" -c "Delete :NSAppTransportSecurity" "$PLIST" 2>/dev/null || true