Makima iOS M2 — networking, auth, onboarding, settings

Stacked on #91 (M0+M1 scaffold). Wires the app up to a real Makima server
via a two-step onboarding flow.

Networking
- APIClient: async URLSession wrapper. Injects x-makima-api-key on every
  request (verified against src/server/auth.rs — API keys use the custom
  header, not Authorization: Bearer). Standard error mapping: 401/403 ->
  unauthorized, 404 -> notFound, 2xx -> decode, else -> http(status, msg).
- APIError: LocalizedError, Equatable.
- ServerProfile: id, label, base URL, last-connected timestamp. Derived
  apiBaseURL ('<base>/api/v1') and apiWebSocketBaseURL (ws/wss scheme
  upgrade). Keychain ID is stable per profile so key storage survives
  label/URL edits.
- Keychain: thin wrapper over SecItem, scoped to service co.soryu.makima.
  kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly.
- ServerProfileStore: @Observable, UserDefaults-backed list of profiles
  with an active-profile UUID. List-ready today for v1.x multi-profile.

Auth state
- AuthStore: @Observable state machine — needsOnboarding | validating |
  authenticated | error(message). configure() validates (server, key) via
  GET /mesh/daemons, then persists. updateBaseURL() hot-swaps the server
  while keeping the key (forces re-onboarding on 401). rotateKey() hits
  POST /auth/api-keys/refresh and swaps in the new key. signOut() wipes
  Keychain + profile.
- AppState: top-level environment bag.

UI
- RootView routes to OnboardingFlow / ValidatingView / HomePlaceholderView
  based on AuthStore.state. Home placeholder shows the masked key so you
  can eyeball that round-trip worked; real Home lands at M3.
- OnboardingFlow: two steps (Server URL, API key paste). Dashed-border
  cards with a 01 SERVER -> 02 KEY pill indicator. 'Open Web Settings'
  deep-links to <server>/settings via UIApplication openURL. Inline
  'mk_' prefix validation on the key field.
- SettingsView: server URL edit, rotate key (with in-flight spinner +
  error surface), sign out. Opened as a sheet from Home.

Tests
- ServerProfileTests: URL normalisation, WebSocket scheme upgrade,
  Keychain ID stability across encode/decode.
- APIClientTests: URLProtocol stub verifies x-makima-api-key injection
  + URL composition + 401 -> APIError.unauthorized mapping.

Not in this PR (landing at M3+): Home composite dashboard, Contracts,
Tasks, WebSocket client, markdown/code rendering, notifications.

0 files changed, 0 insertions, 0 deletions