feat(privacy+dist): telemetry consent gate + app store distribution prep (#4)

* fix(security): fail closed on biometric init error

H-03: setting isAuthenticated: true on initialization failure was a
security bypass — any crash during biometric setup granted full access.
Fail closed instead; user sees auth prompt on next open.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): use Crypto.randomUUID for connection IDs

H-04: Math.random() is not cryptographically random. Connection IDs are
used as SecureStore key suffixes; switch to expo-crypto randomUUID for
a secure source.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(deps): pin expo-crypto to ~15.0.9

15.0.10 does not exist on npm; ~15.0.9 is the latest stable in the 15.x series compatible with Expo SDK 54.

* feat: add OpenCode Connect coming-soon waitlist card

Adds a discoverable 'OpenCode Connect — Coming Soon' card to the
add-connection quick-connect screen. Users can enter their email and
tap 'Join Waitlist' to send a pre-filled mailto. No backend required.

* fix(cua): detect actual screen dimensions and fix JSON parsing

- Get real screen size via `wm size` instead of hardcoding 1080x2400;
  emulator is 1080x1920 so y-coordinates were systematically off
- Extract first JSON object via regex when model returns multiple objects
- Use AZURE_OPENAI_MODEL env var for deployment name (defaults gpt-5.4)
- Add AZURE_DEV_AI_* path for Azure AI Foundry endpoints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): SHA-pin upload-google-play and sanitize notification bodies

M-02: Pin r0adkll/upload-google-play to commit SHA e738b9d (v1.1.5)
to prevent supply-chain hijack via tag mutation.

M-03: Sanitize all push notification bodies — strip control chars,
truncate to 200 chars. Prevents server-supplied strings (error messages,
file paths from permission patterns, session titles) from leaking
unbounded text into the OS notification drawer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(privacy): add telemetry consent gate for Sentry crash reporting

Sentry was always-on, violating F-Droid anti-feature policy and user
trust norms. Now gated behind explicit opt-in:

- First-launch consent modal (TelemetryConsentModal) shows once on
  fresh install; user can Allow or Decline.
- Consent state persisted in expo-secure-store (survives restarts).
- Settings > Privacy section: crash reporting toggle + privacy policy link.
- initSentry() called only after consent granted — not on app start.

Closes #3 (partial)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(config): add real icons and complete iOS/Android app.json config

- Add 1024×1024 app icon, 432×432 adaptive icon foreground, 200×200 splash
- iOS: push notification entitlement (aps-environment: production), speech/
  microphone/camera/photo usage descriptions for future features, disable
  ITSAppUsesNonExemptEncryption
- Android: adaptive icon with dark background (#0F172A), versionCode: 1
- expo-notifications plugin wired in app.json

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(dist): add iOS CI workflow, README rewrite, CONTRIBUTING, and LICENSE

- publish-app-store.yml: EAS Build + TestFlight submission; runs on tag/release/
  workflow_dispatch; bumps ios.buildNumber from github.run_number
- README: full rewrite — features, install badges, connection guide, contributing
- CONTRIBUTING.md: contribution guide for OSS contributors
- LICENSE: MIT

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs(dist): add store listings, strategy, privacy policy, F-Droid/IzzyOnDroid templates

- distribution/strategy.md: monetization strategy (free client + opencode Cloud)
- distribution/play-listing.md: Google Play store copy (name, description, tags)
- distribution/app-store-listing.md: App Store listing copy
- distribution/privacy-policy.{md,html}: GDPR-compliant privacy policy
- distribution/PLAY_CONSOLE_SETUP.md: Play Console setup runbook
- distribution/ios-enrollment-runbook.md: Apple Developer Program enrollment steps
- distribution/SIGNING-KEY-FINGERPRINTS.md: keystore fingerprint for reproducible builds
- distribution/fdroid-submission/: F-Droid metadata template
- distribution/izzyondroid-submission/: IzzyOnDroid submission template
- distribution/whatsnew/: Play Store release notes (en-US)
- distribution/whatsnew-ios/: TestFlight release notes
- distribution/play-graphics/: Play Store screenshot placeholders
- distribution/app-store-graphics/: App Store screenshot placeholders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(telemetry): handle SecureStore failure + Android back button

- add .catch() on loadTelemetryConsent() so SecureStore rejection
  shows the consent modal instead of blocking startup forever
- add onRequestClose={onDecline} to Modal so Android back button
  records the decline rather than silently dismissing
- fix catch block in telemetry.ts to not clobber _resolved when
  SecureStore read fails mid-session

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): run gradlew clean to prevent stale modules.json duplicate

Sentry Gradle plugin writes modules.json to src/main/assets; cached
build intermediates contain an old copy → mergeReleaseAssets fails
with 'Duplicate resources'. Running clean before assembleRelease
clears the intermediate state.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): remove android build output cache causing duplicate modules.json

Caching android/app/build/intermediates and android/app/.cxx causes
two issues:
1. Stale modules.json in intermediates → Duplicate resources error
2. .cxx CMake artifacts reference absolute paths → ninja clean fails

Keeping only Gradle distribution cache (~/.gradle) which is safe.
Expo prebuild regenerates android sources fresh each run anyway.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

distribution/izzyondroid-submission/SUBMISSION-CHECKLIST.md

@@ -0,0 +1,112 @@
+# IzzyOnDroid Submission Checklist
+
+Step-by-step guide to file the inclusion request for `ai.opencode.mobile`
+in the IzzyOnDroid F-Droid repository.
+
+IzzyOnDroid is the fastest OSS distribution channel — typical inclusion is
+1–3 days after filing. It serves pre-built APKs directly from GitHub releases.
+
+**Pre-condition: a signed APK must be attached to a GitHub release tag before filing.**
+
+---
+
+## Prerequisites
+
+- [ ] Signed release APK (not AAB) exists and is attached to a GitHub tag
+      (e.g. `https://github.com/dzianisv/opencode-mobile/releases/tag/v0.2.4`)
+- [ ] APK is signed with `keystores/production-release.jks`
+- [ ] SHA-256 fingerprint confirmed: see `distribution/SIGNING-KEY-FINGERPRINTS.md`
+- [ ] Sentry opt-in gate is in production (avoids `Tracking` anti-feature escalation)
+- [ ] Privacy policy is live at `https://opencode.vibebrowser.app/privacy`
+- [ ] `app.json` `version` and `android.versionCode` are set correctly in the tagged commit
+
+---
+
+## Step 1 — Attach APK to GitHub release
+
+The CI workflow currently builds an AAB (for Play Store). For IzzyOnDroid and
+F-Droid you need a **universal APK**.
+
+Option A — Convert AAB to universal APK with bundletool:
+```bash
+bundletool build-apks \
+  --bundle=android/app/build/outputs/bundle/release/app-release.aab \
+  --output=apks.apks \
+  --mode=universal \
+  --ks=keystores/production-release.jks \
+  --ks-pass=pass:<STOREPASS> \
+  --ks-key-alias=<KEY_ALIAS> \
+  --key-pass=pass:<KEY_PASS>
+
+unzip apks.apks universal.apk -d apk-out/
+# Resulting APK: apk-out/universal.apk → rename to app-release.apk
+```
+
+Option B — Add `assembleRelease` to CI alongside `bundleRelease`, then
+attach the resulting `app-release.apk` to the GitHub release artifact.
+
+Whichever option, attach the `.apk` file to the GitHub release created by the
+release tag.
+
+---
+
+## Step 2 — Verify the APK
+
+```bash
+# Confirm package id and version
+aapt dump badging apk-out/universal.apk | grep -E "package:|versionCode|versionName"
+# Expected:
+#   package: name='ai.opencode.mobile' versionCode='<N>' versionName='<X.Y.Z>'
+
+# Confirm signing fingerprint matches distribution/SIGNING-KEY-FINGERPRINTS.md
+apksigner verify --print-certs apk-out/universal.apk | grep SHA-256
+```
+
+---
+
+## Step 3 — Create a Codeberg account (if needed)
+
+IzzyOnDroid issues are hosted on Codeberg (not GitHub).
+URL: https://codeberg.org
+
+Register or log in at https://codeberg.org/user/sign_up
+
+---
+
+## Step 4 — File the inclusion issue
+
+1. Go to https://codeberg.org/IzzyOnDroid/repodata/issues
+2. Click "New Issue"
+3. Title: `Include ai.opencode.mobile (OpenCode Mobile)`
+4. Body: paste the content from `distribution/izzyondroid-submission/INCLUSION-REQUEST.md`
+   (with all `<PLACEHOLDER>` values replaced)
+5. Submit
+
+---
+
+## Step 5 — Monitor and respond
+
+- IzzyOnDroid maintainers typically respond within 1–3 days.
+- Common requests:
+  - Confirm APK URL pattern resolves correctly
+  - Confirm signing key fingerprint via `apksigner` output
+  - Clarification on anti-features
+- Once accepted, the app appears in the next IzzyOnDroid index build (usually within 24h).
+
+---
+
+## Step 6 — After acceptance
+
+- Add the IzzyOnDroid badge to `README.md`
+- Update `distribution/strategy.md` status row for IzzyOnDroid to "live"
+- Update `docs/fdroid.md` with inclusion date
+- When mainline F-Droid MR is later accepted, comment on this issue:
+  "Mainline F-Droid has accepted ai.opencode.mobile — please auto-delist per policy."
+
+---
+
+## Reference
+
+- IzzyOnDroid inclusion policy: https://apt.izzysoft.de/fdroid/index/info
+- Codeberg issues: https://codeberg.org/IzzyOnDroid/repodata/issues
+- IzzyOnDroid repo (for badge URLs): https://apt.izzysoft.de/fdroid/index/apk/ai.opencode.mobile