feat(companion): add Universal Links for iOS and Android

[carlosvirreira]

Summary

Enable Universal Links so https://app.shelf.nu URLs open in the Shelf Companion app instead of Safari/Chrome.

Changes

iOS (app.json)

• Added associatedDomains: ["applinks:app.shelf.nu"]

Android (app.json)

• Added intentFilters with autoVerify: true for https://app.shelf.nu

Webapp

• Created /.well-known/apple-app-site-association route (Team ID: 27Q4MHFB8K)
• Created /.well-known/assetlinks.json route (SHA256: DB:55:17:D9...)

URLs that will open in app

• https://app.shelf.nu/qr/*
• https://app.shelf.nu/assets/*
• https://app.shelf.nu/bookings/*

⚠️ Considerations for CTO Review

Signing Key Stability

• The Android SHA-256 fingerprint (DB:55:17:D9...) is tied to your EAS production keystore
• If this key ever changes (rare), update assetlinks.json or Android App Links will silently fail
• Your key won't change unless you explicitly rotate it or enroll in Google Play App Signing

Caching

• iOS caches AASA for ~24 hours
• If the .well-known routes return errors after deploy, recovery takes a day
• Test with fresh app installs

Deployment Sequence

1. Deploy webapp first (makes .well-known routes live)
2. Rebuild native apps with eas build
3. Test with fresh install on device

Test plan

• Deploy webapp to staging
• Verify https://staging.app.shelf.nu/.well-known/apple-app-site-association returns JSON
• Verify https://staging.app.shelf.nu/.well-known/assetlinks.json returns JSON
• Build iOS/Android with new config
• Tap https://app.shelf.nu/qr/xxx link → should open in app
• Verify fallback to browser if app not installed

[github-actions]

🩺 React Doctor

✅ No new findings on the files changed by this PR.

_{Run locally with pnpm webapp:doctor for a full scan, or cd apps/webapp && pnpm exec react-doctor . --diff for the same diff-only view.}