Configure Apple Developer signing and TestFlight release automation

Start with docs/mobile-release.md and .github/workflows/release.yml to map the required Apple credentials, GitHub environment, secrets, and production variables. Configure the documented signing and App Store Connect setup, then verify with a reviewed vX.Y.Z tag that the workflow produces an IPA, uploads it to TestFlight, and uses the production server settings.

Context

The repository now contains tag-triggered GitHub Actions release automation in
.github/workflows/release.yml. Android creates a signed AAB artefact. iOS is
intended to build a signed IPA and upload it to TestFlight when a vX.Y.Z tag
is pushed.

Local iOS validation is deferred because this workstation does not currently
have full Xcode or CocoaPods. The hosted macOS GitHub Actions runner will build
the archive once Apple signing and App Store Connect credentials are configured.

See docs/mobile-release.md for the source-of-truth setup instructions.

Required Apple Developer setup

• In Apple Developer, use the generated CSR at
  ~/.offbeat-signing.DuQXRf/ios-distribution.csr to issue an Apple
  Distribution certificate.
• Create an App Store provisioning profile for bundle identifier
  com.offbeat.offbeatMobile using that distribution certificate.
• Export the certificate and private key as a password-protected P12.
• Create an App Store Connect API key with the App Manager role and
  retain its P8 file securely.
• Record the Apple Developer Team ID.

GitHub configuration

Create a protected production GitHub environment, preferably with required
reviewers, then add the secrets and variables documented in
docs/mobile-release.md:

• IOS_CERTIFICATE_P12_BASE64
• IOS_CERTIFICATE_PASSWORD
• IOS_PROVISIONING_PROFILE_BASE64
• APP_STORE_CONNECT_ISSUER_ID
• APP_STORE_CONNECT_KEY_ID
• APP_STORE_CONNECT_PRIVATE_KEY
• APPLE_TEAM_ID
• OFFBEAT_SERVER_URL
• OFFBEAT_RP_ID
• OFFBEAT_SERVER_PUBKEY

The Android secrets are also documented there and should be configured in the
same environment before the first tag release.

Verification

• Push a non-production vX.Y.Z tag only after the required production
  configuration has been reviewed.
• Approve the production environment deployment in GitHub Actions.
• Confirm the workflow creates an IPA artefact and that App Store Connect
  accepts and processes it for TestFlight.
• Confirm the iOS bundle uses the production server URL, RP ID and MainDO
  public key, rather than the local development defaults.