fix(mobile): add Expo app config for iOS associatedDomains and exampl…

[Davoski1]

Summary

Add iOS associated domains wiring for passkeys and example .well-known payloads for domain association.

Changes

• Add frontend/mobile/app.config.js
  • Dynamic Expo config that injects ios.associatedDomains from EXPO_PUBLIC_PASSKEY_RP_ID (e.g. veil.app or your-domain.com) so the generated iOS build includes webcredentials:<rp-id>.
• Add examples in examples/expo/.well-known/:
  • apple-app-site-association.json — example iOS webcredentials payload for hosting at https://<your-domain>/.well-known/apple-app-site-association.
  • assetlinks.json — example Android Digital Asset Links payload for hosting at https://<your-domain>/.well-known/assetlinks.json.

Why

Mobile passkeys on iOS require the native app entitlement associatedDomains with an entry of the form webcredentials:<rp-id>. This change enables builds to pick the relying-party id from the environment (so secrets/hostnames aren't baked into source) and provides example .well-known payloads that must be hosted on the web origin to complete the platform association.

Notes for maintainers / operators

• Set EXPO_PUBLIC_PASSKEY_RP_ID (e.g. veil.app or your-domain.com) in your CI/EAS or local environment before building iOS artifacts so the entitlement is injected.
• Host apple-app-site-association at https://<domain>/.well-known/apple-app-site-association (the URL typically omits the .json suffix). Serve it over HTTPS with application/json content-type.
• Replace placeholders in the example files:
  • iOS: <TEAM_ID>.<BUNDLE_ID>
  • Android: <your.package.name> and <SHA256> fingerprint(s)

Testing / Verification

1. Build an iOS app with EXPO_PUBLIC_PASSKEY_RP_ID set and verify associatedDomains contains webcredentials:<rp-id> in the generated entitlements.
2. Host apple-app-site-association on the domain and confirm iOS recognizes the association (device logs / Apple verification tools).
3. Verify passkey flows between the domain and the iOS app (registering and using a passkey).

---

Closes #446

[vercel]

@rhoggs-bot-test-account is attempting to deploy a commit to the miracle656's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Davoski1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits