Handle magic-link sign-in via universal links / app links

[akulsharma1]

Summary

Tapping a magic-link email (https://reflectionsprojections.org/auth/mobile/login?token=…) should open rp-mobile and sign the user in. The server half — serving .well-known/apple-app-site-association and .well-known/assetlinks.json on the domain — ships from rp-web (ReflectionsProjections/rp-web#134; assetlinks is already live). This PR adds everything on the app side, for both iOS and Android.

Changes

Domain association (both platforms)

• iOS: associatedDomains: ['applinks:reflectionsprojections.org'] in app.config.js and com.apple.developer.associated-domains in the checked-in entitlements file.
• Android: autoVerify https intent filter for host reflectionsprojections.org, path prefix /auth/mobile/login, in app.config.js and the checked-in AndroidManifest.xml (kept in sync since the native projects are committed).

Link handling

• app/auth/mobile/login.tsx: expo-router route matching the link's path. Reads token, posts /auth/magic-links/verify with client: 'mobile', stores the JWT in SecureStore, checks /auth/info roles and routes to home — mirroring the existing Google sign-in flow. Invalid/expired tokens alert and return to sign-in.

Requesting a link

• New (auth)/email-sign-in screen: email input → POST /auth/magic-links (client: 'mobile'", intent: 'login') → "check your email" state. Linked from the sign-in screen. Copy doesn't disclose whether an account exists (API returns 202 either way; mobile links require an existing USER role).
• Typed APIRoutes entries for both magic-link endpoints.

Testing

• npx tsc --noEmit: only the two pre-existing errors on main (tabs scrollRef, shiftsSlice); no new errors.
• npx eslint on changed screens: no errors (2 pre-existing warnings in sign-in.tsx).
• Manual (after a dev build): request a link from the email screen for a registered account, tap it in Mail/Gmail — app opens on the verify screen and lands on home signed in. adb shell pm get-app-links com.reflectionsprojections should show the domain verified; on iOS, long-press the link → "Open in rp-mobile".

Deployment notes

• iOS: the App ID must have the Associated Domains capability enabled (EAS/Xcode automatic signing handles this on next build). Apple's CDN caches the AASA up to ~24h after rp-web#134 deploys; the "Associated Domains Development" toggle in iOS developer settings bypasses it for testing.
• Android: assetlinks.json is already live with the release-cert fingerprint; verification happens at install/update.
• Requires new store builds — this is native config, not OTA-updatable.

🤖 Generated with Claude Code