feat: add HomeSec iOS app shell MVP

.github/workflows/ci.yml

@@ -90,9 +90,54 @@ jobs:
       - name: UI check
         run: pnpm --dir ui check
 
+      - name: Install Playwright browsers
+        run: pnpm --dir ui exec playwright install --with-deps chromium webkit
+
+      - name: UI e2e
+        run: pnpm --dir ui test:e2e
+
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml
           fail_ci_if_error: false
+
+  ios-native:
+    runs-on: macos-26
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.15.1
+          run_install: false
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.12.0"
+          cache: pnpm
+          cache-dependency-path: ui/pnpm-lock.yaml
+
+      - name: Install UI dependencies
+        run: pnpm --dir ui install --frozen-lockfile
+
+      - name: Sync Capacitor iOS project
+        run: pnpm --dir ui ios:sync
+
+      - name: Verify committed iOS sync output
+        run: git diff --exit-code -- ui/ios ui/capacitor.config.ts ui/package.json ui/pnpm-lock.yaml
+
+      - name: Build iOS simulator app
+        run: |
+          xcodebuild \
+            -project ui/ios/App/App.xcodeproj \
+            -scheme App \
+            -destination 'generic/platform=iOS Simulator' \
+            -configuration Debug \
+            CODE_SIGNING_ALLOWED=NO \
+            build

alembic/versions/7b0b1fbfc69b_add_mobile_device_registry.py

@@ -0,0 +1,77 @@
+"""add mobile device registry
+
+Revision ID: 7b0b1fbfc69b
+Revises: d936851f725a
+Create Date: 2026-06-14 00:00:00.000000
+
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "7b0b1fbfc69b"
+down_revision: str | None = "d936851f725a"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "mobile_devices",
+        sa.Column("id", sa.Text(), nullable=False),
+        sa.Column("platform", sa.Text(), nullable=False),
+        sa.Column("apns_token_hash", sa.Text(), nullable=False),
+        sa.Column("apns_token", sa.Text(), nullable=False),
+        sa.Column("apns_environment", sa.Text(), nullable=False),
+        sa.Column("bundle_id", sa.Text(), nullable=False),
+        sa.Column("device_name", sa.Text(), nullable=True),
+        sa.Column("app_version", sa.Text(), nullable=True),
+        sa.Column(
+            "capabilities",
+            postgresql.JSONB(astext_type=sa.Text()),
+            server_default=sa.text("'{}'::jsonb"),
+            nullable=False,
+        ),
+        sa.Column("enabled", sa.Boolean(), server_default=sa.text("true"), nullable=False),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=False,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=False,
+        ),
+        sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("last_push_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("last_push_error", sa.Text(), nullable=True),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("apns_token_hash", name="uq_mobile_devices_apns_token_hash"),
+    )
+    op.create_index("idx_mobile_devices_enabled", "mobile_devices", ["enabled"], unique=False)
+    op.create_index(
+        "idx_mobile_devices_platform_environment",
+        "mobile_devices",
+        ["platform", "apns_environment"],
+        unique=False,
+    )
+    op.create_index(
+        "idx_mobile_devices_updated_at_desc",
+        "mobile_devices",
+        [sa.literal_column("updated_at DESC")],
+        unique=False,
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("idx_mobile_devices_updated_at_desc", table_name="mobile_devices")
+    op.drop_index("idx_mobile_devices_platform_environment", table_name="mobile_devices")
+    op.drop_index("idx_mobile_devices_enabled", table_name="mobile_devices")
+    op.drop_table("mobile_devices")