Configure Apple Developer signing and TestFlight release automation

## Context

The repository now contains tag-triggered GitHub Actions release automation in
`.github/workflows/release.yml`. Android creates a signed AAB artefact. iOS is
intended to build a signed IPA and upload it to TestFlight when a `vX.Y.Z` tag
is pushed.

Local iOS validation is deferred because this workstation does not currently
have full Xcode or CocoaPods. The hosted macOS GitHub Actions runner will build
the archive once Apple signing and App Store Connect credentials are configured.

See `docs/mobile-release.md` for the source-of-truth setup instructions.

## Required Apple Developer setup

- [ ] In Apple Developer, use the generated CSR at
`~/.offbeat-signing.DuQXRf/ios-distribution.csr` to issue an **Apple
Distribution** certificate.
- [ ] Create an **App Store** provisioning profile for bundle identifier
`com.offbeat.offbeatMobile` using that distribution certificate.
- [ ] Export the certificate and private key as a password-protected P12.
- [ ] Create an App Store Connect API key with the **App Manager** role and
retain its P8 file securely.
- [ ] Record the Apple Developer Team ID.

## GitHub configuration

Create a protected `production` GitHub environment, preferably with required
reviewers, then add the secrets and variables documented in
`docs/mobile-release.md`:

- [ ] `IOS_CERTIFICATE_P12_BASE64`
- [ ] `IOS_CERTIFICATE_PASSWORD`
- [ ] `IOS_PROVISIONING_PROFILE_BASE64`
- [ ] `APP_STORE_CONNECT_ISSUER_ID`
- [ ] `APP_STORE_CONNECT_KEY_ID`
- [ ] `APP_STORE_CONNECT_PRIVATE_KEY`
- [ ] `APPLE_TEAM_ID`
- [ ] `OFFBEAT_SERVER_URL`
- [ ] `OFFBEAT_RP_ID`
- [ ] `OFFBEAT_SERVER_PUBKEY`

The Android secrets are also documented there and should be configured in the
same environment before the first tag release.

## Verification

- [ ] Push a non-production `vX.Y.Z` tag only after the required production
configuration has been reviewed.
- [ ] Approve the `production` environment deployment in GitHub Actions.
- [ ] Confirm the workflow creates an IPA artefact and that App Store Connect
accepts and processes it for TestFlight.
- [ ] Confirm the iOS bundle uses the production server URL, RP ID and MainDO
public key, rather than the local development defaults.

Start with docs/mobile-release.md and .github/workflows/release.yml to map the required Apple credentials, GitHub environment, secrets, and production variables. Configure the documented signing and App Store Connect setup, then verify with a reviewed vX.Y.Z tag that the workflow produces an IPA, uploads it to TestFlight, and uses the production server settings.

Written by the indexing model from the issue text.