Complete native Setline account and sync parity

[sarthakagrawal927]

Finish OpenSpec task 4.1 for the iPhone client: isolated browser authentication, Keychain session storage, whole-state sync status and conflict handling, sign out, and account deletion. Keep the local workout path fully usable and avoid production writes until the native callback/API contract is reviewed.

[sarthakagrawal927]

Implementation review found one blocking native-session contract gap, so I am parking this issue without speculative auth code or production writes. Setline already provides the right whole-state primitives: /api/app/state has bounded GET/PUT payloads and deterministic 409 conflict responses, and Better Auth exposes fresh-session-protected account deletion. However, both private state and deletion authenticate only through the browser session cookie. ASWebAuthenticationSession cannot transfer that cookie into the app URLSession, and the only bearer-token path in this repository is explicitly read-only MCP access.

Decision needed before OpenSpec task 4.1 can be completed: approve a native callback/token exchange with scoped state read/write and deletion authorization, plus revocation and fresh-session behavior. Once that contract is reviewed, the Swift client can add Keychain persistence, device-only/pending/synced/conflict/error states, explicit local-vs-cloud conflict choices, sign out, and the existing deletion recovery copy against real endpoints. Repository and production state were not modified.