build(ios): Codemagic pipeline + runbook for App Store (no Mac needed)

The iOS app is a Capacitor shell over the live web UI — the web/server side is already fully
Capacitor-ready (nativePlatform() detects Capacitor; setupNativePush registers APNs tokens via
/api/v1/devices; the APNs sender is built into server/push.js, config-gated). So this adds only
the build/sign/upload path:

- codemagic.yaml: macOS-cloud workflow that generates the iOS project, patches Info.plist,
  generates icons/splash, signs via an App Store Connect API key (automatic signing), archives,
  and uploads to TestFlight. No Mac required.
- mobile/scripts/ios-patch.sh: adds the App-Review privacy usage strings (camera/mic/photos) +
  display name to the generated Info.plist.
- mobile/IOS_SETUP.md: click-by-click runbook — ASC app record, API key, Codemagic integration,
  first build, APNs key → server .env, and the public-submission checklist.

Bundle id com.bizgaze.connect. No secrets committed — Apple keys live in Codemagic + server .env.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

mobile/scripts/ios-patch.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Patch the freshly-generated Capacitor iOS project (mobile/ios/App) for App Store submission.
+# Runs on the Codemagic macOS instance after `npx cap add ios`. Idempotent — safe to re-run.
+set -euo pipefail
+
+PLIST="mobile/ios/App/App/Info.plist"
+PB=/usr/libexec/PlistBuddy
+
+set_str() {  # set_str <key> <value>  — add the key if missing, else overwrite
+  "$PB" -c "Add :$1 string $2" "$PLIST" 2>/dev/null || "$PB" -c "Set :$1 $2" "$PLIST"
+}
+
+echo "Patching $PLIST"
+
+# ── Privacy usage strings (Apple REJECTS the build if a used capability has no purpose string) ──
+set_str NSCameraUsageDescription      "Biz Connect uses the camera for video calls and to share photos and your screen."
+set_str NSMicrophoneUsageDescription  "Biz Connect uses the microphone for voice and video calls."
+set_str NSPhotoLibraryUsageDescription      "Biz Connect needs photo access so you can send images in chat."
+set_str NSPhotoLibraryAddUsageDescription   "Biz Connect saves images and recordings you download to your photos."
+
+# Human-readable display name on the home screen.
+set_str CFBundleDisplayName "Biz Connect"
+
+# Allow the webview to load our HTTPS origin (we do NOT enable arbitrary cleartext).
+"$PB" -c "Delete :NSAppTransportSecurity" "$PLIST" 2>/dev/null || true
+
+echo "Info.plist patched:"
+"$PB" -c "Print :NSCameraUsageDescription" "$PLIST"
+"$PB" -c "Print :NSMicrophoneUsageDescription" "$PLIST"