Bring the checklist app under version control

The project has lived only as a folder on the Mac Studio and, briefly, as a
transfer tarball. This is the first commit: the Express server and its web
front end, the Capacitor iOS and Android wrappers, and the release and backup
scripts.

The repo is the source, not a backup of the machine. Left out on purpose, by
the .gitignore files that were already in the tree: node_modules, build output,
mobile/www (regenerated from server/public on every build), and server/data,
which holds the live checklists and belongs on the NAS rather than in git.

Every credential is excluded too — server/.env, the Play upload keystore and
its properties file, the App Store Connect key and ios-signing.config. The one
secret that was not in an ignored file was the NAS SSH password, hard-coded in
build-deploy.sh and grepped back out of it by backup-to-drive.sh. Both now read
it from the login keychain (service checklist-nas, account Christian), falling
back to NAS_PASS in the environment, so rotating it is one keychain entry
rather than a history rewrite.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

LAPTOP-SETUP.md

@@ -0,0 +1,107 @@
+# Moving checklist development to another Mac
+
+The project folder is most of it, but three things live outside it, and one thing should
+deliberately **stay** on the Mac Studio.
+
+---
+
+## What to copy
+
+`checklist-app-transfer.tgz` — the whole project minus `node_modules`, build output and
+secrets (all of which are either regenerated or restored separately). Unpack it wherever you
+like; nothing depends on the path except the two config files noted below.
+
+```bash
+mkdir -p ~/Documents && tar -xzf checklist-app-transfer.tgz -C ~/Documents
+```
+
+## What the laptop needs installed
+
+| | How |
+|---|---|
+| **Xcode** | Mac App Store. Then `sudo xcodebuild -license accept` and open it once. |
+| **Node 20+** | [nodejs.org](https://nodejs.org) installer |
+| **JDK 21** | see below |
+| **Android SDK** | see below |
+
+No Homebrew and no CocoaPods are needed — iOS uses Swift Package Manager deliberately,
+because the system Ruby is too old for CocoaPods.
+
+```bash
+# JDK 21
+curl -L -o /tmp/jdk.tar.gz 'https://api.adoptium.net/v3/binary/latest/21/ga/mac/aarch64/jdk/hotspot/normal/eclipse'
+mkdir -p ~/.jdks && tar -xzf /tmp/jdk.tar.gz -C ~/.jdks && mv ~/.jdks/jdk-21* ~/.jdks/temurin-21
+
+# Android command-line tools + SDK
+curl -L -o /tmp/cmdtools.zip 'https://dl.google.com/android/repository/commandlinetools-mac-13114758_latest.zip'
+mkdir -p ~/Library/Android/sdk/cmdline-tools && unzip -q /tmp/cmdtools.zip -d /tmp
+mv /tmp/cmdline-tools ~/Library/Android/sdk/cmdline-tools/latest
+yes | ~/Library/Android/sdk/cmdline-tools/latest/bin/sdkmanager --sdk_root="$HOME/Library/Android/sdk" --licenses
+~/Library/Android/sdk/cmdline-tools/latest/bin/sdkmanager --sdk_root="$HOME/Library/Android/sdk" \
+  "platform-tools" "platforms;android-36" "build-tools;36.0.0"
+
+# Project dependencies
+cd ~/Documents/recurring-checklist-app/mobile && npm install
+cd ../server && npm install
+```
+
+Then edit `mobile/android/local.properties` so `sdk.dir` points at the new machine's home
+directory — it is machine-specific and will be wrong after a copy.
+
+## Restore the secrets
+
+They are **not** in the transfer bundle on purpose. They are already in
+`checklist-signing-backup.dmg` (Google Drive → `Apps/Backups`). Open it and:
+
+| From the DMG | Goes to |
+|---|---|
+| `android/upload-keystore.jks` | `<project>/mobile/keystore/upload-keystore.jks` |
+| `android/keystore.properties` | `<project>/mobile/keystore.properties` |
+| `ios/AuthKey_NXR7767SYK.p8` | `~/.appstoreconnect/private_keys/` |
+| `ios/ios-signing.config` | `<project>/mobile/ios-signing.config` |
+| — | `<project>/server/.env` — copy from the Studio; it is not in the DMG |
+
+```bash
+chmod 600 ~/.appstoreconnect/private_keys/AuthKey_NXR7767SYK.p8
+```
+
+Then fix the absolute path inside `keystore.properties`:
+
+```
+storeFile=/Users/<you>/Documents/recurring-checklist-app/mobile/keystore/upload-keystore.jks
+```
+
+**The iOS distribution certificate is not copied.** Sign into Xcode ▸ Settings ▸ Accounts
+with the same Apple ID and run `./release.sh --ios`; `-allowProvisioningUpdates` mints a new
+certificate for the new machine automatically. Nothing needs exporting from the old keychain.
+
+## Check it works
+
+```bash
+./mobile/scripts/verify-asc-key.sh        # authenticates against App Store Connect
+cd mobile && node scripts/sync-web.js     # rebuilds www/ from server/public
+cd android && . ../scripts/env.sh && ./gradlew :app:bundleRelease --no-daemon
+```
+
+A signed `.aab` means Android is fully restored. `./release.sh --ios` proves the Apple side.
+
+---
+
+## What must STAY on the Mac Studio
+
+**The nightly off-site backup.** `backup-to-drive.sh` plus the LaunchAgent
+`org.waterschurch.checklist-drive-backup` should keep running here, not on the laptop:
+
+- a LaunchAgent only fires while the machine is awake and logged in — a laptop that sleeps or
+  goes home silently stops backing up, and the failure is invisible
+- it needs the LAN to reach the NAS at `10.1.1.5`
+
+Leave both in place on the Studio. If the laptop ever becomes the only machine, move the
+script and reinstall the LaunchAgent there — and check the log afterwards.
+
+## The other thing that needs the LAN
+
+`build-deploy.sh` (and therefore `./release.sh`) pushes to the NAS at `10.1.1.5`. **Web
+deploys only work on the church network.** Off-site you can still build and upload the iOS
+and Android apps — those only need the internet — but `./release.sh --web` will fail until
+you are back on the LAN or on a VPN into it.