feat: start BragStack mobile app for iOS and Android - #201

Closes #200 when the full mobile epic is complete. This draft now contains the real iOS/Android application foundation plus a substantial store-readiness pass; it is intentionally still pre-release and must not be described as publicly downloadable yet.

Implemented

• React Native / Expo cross-platform app under mobile/
• iOS bundle ID and Android package com.bragstack.app
• canonical BragStack brandmark and authenticated-app visual system
• responsive phone/tablet layout using real viewport dimensions and safe areas
• portrait and landscape support, including tablet-specific navigation/layout behavior
• Home, Proof, Add, Profile, and Settings navigation
• real password sign-in through /auth/login
• in-app registration through /auth/register
• verification-email resend UX
• password-reset request UX
• encrypted token storage with Expo SecureStore
• session restore through /auth/me
• sign out that clears the local token
• native Google/GitHub OAuth intentionally withheld until the callback flow and Apple sign-in requirements are satisfied
• live accomplishments and Impact Receipts from the existing FastAPI backend
• real private-by-default accomplishment creation through /entries
• real profile editing through /auth/me/profile
• pull-to-refresh plus loading, empty, and API-error states
• EAS preview/production profiles configured for the canonical production BragStack API
• Codespaces web preview shortcut for testing against production API
• mobile CI: Expo Doctor, unit/coverage tests, and Expo export smoke test

Mobile UX fix

The earlier web/DevTools mobile preview could render a 560px auth shell inside a ~440px phone viewport, causing horizontal clipping and a compressed-looking login page. The auth and page containers now derive their width from useWindowDimensions() and stay within the actual device viewport instead of relying on desktop-style max-width behavior.

Tablet and landscape layouts now adapt rather than merely stretching phone UI: phone navigation remains bottom-tab based, tablet-width layouts use a side rail, wide tablet screens use broader multi-column presentation where appropriate, and short landscape screens remain scrollable.

Data/truth contract

• Home and Proof use live authenticated data rather than demo receipt counts/cards.
• Quick Capture writes a real accomplishment and forces is_public: false.
• The capture flow requires context, contribution, and impact so mobile does not fabricate missing professional outcomes.
• Impact Receipts are read live; full mobile receipt creation/evidence/verification remains later work.

Authentication notes

BragStack Mobile reuses the existing identity system. Registration and password recovery use the production backend. Verification/reset emails currently finish in the web experience; native recovery deep links remain release-hardening work.

Third-party social sign-in is hidden on native for now because the current backend callback returns to the web client. Shipping Google/GitHub buttons in an iOS app before implementing a native callback and the applicable Apple sign-in requirement would create avoidable store-review risk.

Store/build foundation

• Expo / EAS configuration for iOS and Android
• production API configuration: https://api.usebragstack.com
• no unnecessary native permissions in the current foundation
• mobile engineering, testing, customer, roadmap, privacy, and release documentation

Public-store blockers — do not call store-ready yet

• in-app account deletion and end-to-end deletion verification
• native verification/reset deep links or a fully validated web-return flow
• accessibility and dynamic-text validation
• app icon, splash screen, screenshots, and store metadata
• Apple privacy disclosures / required-reason review
• Google Play Data safety disclosure
• signing and release credentials
• TestFlight and Play internal testing
• device/OS compatibility QA
• security review of token lifecycle, deep links, logs, analytics, and evidence handling
• native social sign-in only after callback + Apple requirements are satisfied

Release / changelog truth

CHANGELOG.md records merged/shipped work only. This draft intentionally does not record itself as shipped. Add the notable mobile entry through the protected-main changelog workflow only after an actually reviewed/merged mobile milestone lands.

Validation target

Do not merge until the exact PR head is green for Mobile CI, Frontend CI, Backend CI, Security CI, and any other required checks.