fix(mobile): Sign personal iOS builds and require a private push relay#67

What Changed

iOS builds made with T3CODE_IOS_PERSONAL_TEAM=1 sign with their own team (T3CODE_IOS_TEAM_ID) and bundle id and keep the share extension ("Send To"), the widgets extension and keychain sharing. The app and both extensions share the App Group group.<bundle id>. An explicitly supplied signing team is validated before prebuild.

Push notifications and Live Activities stay off for these builds unless both T3CODE_IOS_PERSONAL_PUSH_RELAY=1 and a valid private T3CODE_BACKGROUND_RELAY_URL are set. Primary-relay and t3.codes hostnames are rejected after parsing, and background operations never fall back to the primary relay. Without a usable private relay, the app registers no device or activity tokens, starts no Live Activity cards, and shows those settings as unavailable, while T3 Connect keeps working. Personal builds re-register their device on cold start and on foreground at most once a minute. Associated domains for the T3 relying party and native Sign in with Apple stay off. Builds without T3CODE_IOS_PERSONAL_TEAM are unchanged.

Why

T3's hosted relay cannot sign APNs for another team, so push and Live Activity updates for a personal build must come from a relay holding that team's key (the personal relay layer above). Turning them on without one would register tokens that never receive anything and start cards that never update or end.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes