App Store submission blockers: project config, auth, paywall, privacy

[astrayama]

What this is

Everything code-side that blocked App Store submission, fixed in one reviewable branch. Companion doc: docs/app-store-launch-guide.md — the step-by-step launch checklist for the account-side work (key rotation, App Store Connect, Supabase, RevenueCat).

Fixes

Release engineering

• project.yml is now the single source of truth and matches the committed pbxproj: bundle ID pinned to com.screenseiji.anicca, team P788RWL6YN, automatic signing, shared scheme committed. Running ./setup.sh no longer silently reverts hand-edits.
• New Anicca/Anicca.entitlements with Sign In with Apple (was missing entirely — runtime error 1000, unprovisionable).
• New Anicca/Resources/PrivacyInfo.xcprivacy (UserDefaults CA92.1; declares email, name, user ID, journal content, emotional-state data; no tracking).
• Info.plist: removed unused UIBackgroundModes (remote-notification, bluetooth-peripheral — Guideline 2.5.4), removed bogus NSUserNotificationsUsageDescription, version/build now come from MARKETING_VERSION/CURRENT_PROJECT_VERSION (were hardcoded, which blocks every TestFlight upload after the first).
• App icon alpha channel flattened (ITMS-90717 upload rejection).

Delete account / auth (Guideline 5.1.1(v))

• Apple re-auth no longer depends on a nonce captured during same-process sign-in — the ASAuthorization delegate now serves only the delete flow. Previously reauthenticateWithApple stored its nonce in deleteAccountNonce while the delegate read appleNonce (nil after fresh launch), so Apple users could never delete their account.
• Second independent bug: provider detection cast AnyJSON to String (always fails), so every restored session was treated as email — routing Apple/Google users to a password prompt in the delete flow. Now reads .stringValue.
• Cancelling the re-auth sheet resumes the continuation instead of hanging the task forever.
• Sign in with Apple shows one sheet, not two: the SignInWithAppleButton result is now used instead of discarded and re-run through a second ASAuthorizationController.

Paywall / monetization

• Footer states each loaded subscription's title, length, and price plus Apple's auto-renewal terms.
• Prices come only from loaded StoreKit products; offerings-load failure shows a retry state instead of hardcoded fallback prices with buy buttons that can't succeed.
• The hidden 5-tap developer_override_pro unlock compiles out of Release (Guideline 2.3.1).
• Reminders are free for everyone (REMIND-01): onboarding already scheduled them for free users, who then couldn't turn them off in Pro-gated Settings.

Hygiene

• Secrets.xcconfig.example scrubbed to placeholders. ⚠️ The previous live values are in git history — the Gemini key must be rotated (guide Phase 0).
• All 21 release print() calls (auth/profile/Gemini error bodies) replaced with debugLog(), which compiles out of Release.
• SupabaseSetup.md: corrected bundle ID, explicit WITH CHECK on RLS policies, new deploy+verify section for the delete-account edge function.

Verification

• xcodegen generate + xcodebuild (iOS Simulator): build succeeded; the two always-failing-cast warnings in AuthService are gone; no new warnings introduced.
• Built bundle inspected: com.screenseiji.anicca, 1.0.0 (1), no background modes, PrivacyInfo.xcprivacy embedded, icon 1024×1024 with hasAlpha: no, all three plists plutil -lint clean.
• Smoke test on iPhone 17 Pro simulator: app boots to the auth screen.
• Apple sign-in, sandbox purchases, and end-to-end delete need a device/TestFlight — covered by the guide's Phase 6 checklist.

🤖 Generated with Claude Code