fix(ios): inject aps-environment entitlement so APNs push registration works

The @capacitor/push-notifications plugin does not add the Push Notifications
capability to the CI-generated Xcode project (that's a manual Xcode step), and
add-share-extension.rb only merged the App Group into App.entitlements, assuming
aps-environment was already there. It never was — so on device PushNotifications.
register() failed with 'no valid aps-environment entitlement', no APNs token was
obtained, and device_tokens stayed empty (server had nothing to push to).

ios-patch.sh now creates App/App.entitlements with aps-environment=production
before the share-extension script merges the App Group in. Still requires the App
ID to have Push Notifications enabled (so the profile carries the entitlement) and
the server APNS_* key set (Step 5) for end-to-end delivery.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

mobile/IOS_SETUP.md

@@ -40,7 +40,17 @@ On the **Register an App ID** page, only three fields matter — leave everythin
 - Add yourself under **TestFlight → Internal Testing** to install via the TestFlight app on your iPhone.
 
 ## Step 5 — Push notifications (APNs) — do this once, then tell me
-So the app gets **calls/messages while it's closed**:
+So the app gets **calls/messages while it's closed**. Two independent pieces must BOTH be in place:
+
+> **A. App ID capability (client side).** The App ID `com.bizgaze.connect` must have **Push Notifications**
+> enabled (Step 0 ticks it). The build now injects the `aps-environment` entitlement automatically
+> (`ios-patch.sh`), so the app can obtain an APNs token — but if the App ID lacks the Push capability, the
+> archive fails code-signing on `aps-environment`. If a build errors on that after you enable the
+> capability, delete the app's provisioning profile in App Store Connect so the next Codemagic run
+> regenerates one that includes push.
+>
+> **B. APNs key (server side).** Do the two steps below so the server can actually SEND to that token.
+
 1. developer.apple.com → **Keys → +** → enable **Apple Push Notifications service (APNs)** → download the
    **`.p8`**. Note its **Key ID** and your **Team ID** (top-right of the developer portal).
 2. **Send me**: the `.p8` contents, the **Key ID**, and the **Team ID**. I set these in the server `.env`

mobile/scripts/ios-patch.sh

@@ -51,6 +51,31 @@ if ! "$PB" -c "Print :CFBundleURLTypes" "$PLIST" >/dev/null 2>&1; then
   "$PB" -c "Add :CFBundleURLTypes:0:CFBundleURLSchemes:0 string bizconnect" "$PLIST"
 fi
 
+# ── Push Notifications entitlement (aps-environment) ────────────────────────────────────────────────
+# The @capacitor/push-notifications plugin does NOT add the Push Notifications capability to the generated
+# Xcode project — in Xcode that's a manual "Signing & Capabilities → + Push Notifications" click, which
+# never happens on a fresh CI checkout. Without the aps-environment entitlement, PushNotifications.register()
+# fails on device ("no valid 'aps-environment' entitlement string found") and NO APNs token is ever
+# obtained, so device_tokens stays empty and the server has nothing to push to. Create the entitlements
+# file with aps-environment HERE; add-share-extension.rb (runs after this) MERGES the App Group into the
+# same file, preserving this key. REQUIRES: the App ID com.bizgaze.connect must have the Push Notifications
+# capability enabled in the Apple Developer portal, so the fetched provisioning profile carries
+# aps-environment — otherwise the archive fails code-signing. "production" is correct for App Store +
+# TestFlight (pair it with APNS_PRODUCTION=1 on the server).
+ENT="mobile/ios/App/App/App.entitlements"
+if [ ! -f "$ENT" ]; then
+  cat > "$ENT" <<'PLIST'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+</dict>
+</plist>
+PLIST
+fi
+"$PB" -c "Add :aps-environment string production" "$ENT" 2>/dev/null || "$PB" -c "Set :aps-environment production" "$ENT"
+echo "Entitlements: aps-environment=production ensured in $ENT"
+
 # We use only standard encryption (HTTPS/TLS), which is exempt — declaring this up front stops App Store
 # Connect from asking the "export compliance" question on every single build/TestFlight upload.
 "$PB" -c "Add :ITSAppUsesNonExemptEncryption bool false" "$PLIST" 2>/dev/null \