Bring the checklist app under version control

The project has lived only as a folder on the Mac Studio and, briefly, as a
transfer tarball. This is the first commit: the Express server and its web
front end, the Capacitor iOS and Android wrappers, and the release and backup
scripts.

The repo is the source, not a backup of the machine. Left out on purpose, by
the .gitignore files that were already in the tree: node_modules, build output,
mobile/www (regenerated from server/public on every build), and server/data,
which holds the live checklists and belongs on the NAS rather than in git.

Every credential is excluded too — server/.env, the Play upload keystore and
its properties file, the App Store Connect key and ios-signing.config. The one
secret that was not in an ignored file was the NAS SSH password, hard-coded in
build-deploy.sh and grepped back out of it by backup-to-drive.sh. Both now read
it from the login keychain (service checklist-nas, account Christian), falling
back to NAS_PASS in the environment, so rotating it is one keychain entry
rather than a history rewrite.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mobile/ios-signing.config.example

@@ -0,0 +1,24 @@
+# iOS signing — copy to `ios-signing.config` (gitignored) and fill in.
+#
+#   cp mobile/ios-signing.config.example mobile/ios-signing.config
+#
+# Until this file exists, `./release.sh` builds the website and the Android app and SKIPS
+# iOS with a note. Nothing else breaks.
+
+# ── Required ───────────────────────────────────────────────────────────────────────────
+# Your Apple Developer Team ID: 10 characters, e.g. A1B2C3D4E5.
+# Find it at https://developer.apple.com/account → Membership details → Team ID.
+DEVELOPMENT_TEAM=
+
+# ── Optional: hands-off upload to App Store Connect ────────────────────────────────────
+# Without these, release.sh still produces a signed .ipa in dist-release/ and you upload it
+# by hand (Xcode ▸ Window ▸ Organizer ▸ Distribute App, or the Transporter app). With them,
+# release.sh uploads it for you — worth setting up once if you ship often.
+#
+# Create the key at App Store Connect → Users and Access → Integrations → App Store Connect
+# API → "+". Role "App Manager" is enough. You can download the .p8 ONCE, so save it
+# immediately to ~/.appstoreconnect/private_keys/AuthKey_<KEYID>.p8 — xcrun looks there by
+# name, which is why there's no path setting here.
+#
+# ASC_KEY_ID=XXXXXXXXXX
+# ASC_ISSUER_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx