Add agent instructions; extract signing/backend secrets from source

- Add AGENTS.md (canonical) + CLAUDE.md symlink + ROADMAP.md
- Move Apple Team ID from project.yml into a gitignored
  Config/Signing.xcconfig via configFiles; commit the .example template
- Replace hardcoded backend host in AppSettings with a neutral
  placeholder + SPARK_BACKEND_URL env-var fallback
- Scrub the Team ID, .local host, and raw LAN IP from README/docs
- Ignore Config/Signing.xcconfig and .env

README.md

@@ -14,25 +14,30 @@ This repo is at **Phase 0** (scaffold, permissions, backend health check).
    ```sh
    brew install xcodegen
    ```
-3. **Generate the project:**
+3. **Set your signing team.** The Apple Team ID is kept out of source in a
+   gitignored `Config/Signing.xcconfig`. Copy the template and set your team:
+   ```sh
+   cp Config/Signing.xcconfig.example Config/Signing.xcconfig   # then set DEVELOPMENT_TEAM
+   ```
+   `xcodegen` wires it in via `configFiles`, so **Signing & Capabilities** shows the
+   team automatically — no manual selection. Keep the value stable so macOS
+   preserves the app's permission (TCC) grants across rebuilds. Edit the xcconfig,
+   not Xcode — `xcodegen generate` overwrites Xcode-side changes.
+4. **Generate the project:**
    ```sh
    xcodegen generate
    ```
    This creates `Ten31Transcripts.xcodeproj` (git-ignored — regenerate any time).
-4. **Open it:**
+5. **Open it:**
    ```sh
    open Ten31Transcripts.xcodeproj
    ```
-5. Signing is preconfigured: `project.yml` sets `DEVELOPMENT_TEAM` to the free
-   personal team `BK4Y6CXN35` with automatic signing, so **Signing & Capabilities
-   should already show the team** — no manual selection needed. (If you ever sign
-   with a different Apple ID, update `DEVELOPMENT_TEAM` in `project.yml`, not in
-   Xcode — `xcodegen generate` overwrites Xcode-side changes.)
 6. Press **Run** (⌘R).
 
 > **Note:** after adding files in a new phase, re-run `xcodegen generate` and let
 > Xcode reload the project. The signing team persists because it lives in
-> `project.yml`, so macOS permissions stay granted across rebuilds.
+> `Config/Signing.xcconfig` (gitignored), so macOS permissions stay granted across
+> rebuilds.
 
 ## What Phase 0 does
 
@@ -64,5 +69,6 @@ Ten31TranscriptsTests/          # placeholder; real tests land in Phase 3
 
 - **App Sandbox is off** and **Hardened Runtime is off** — this is a personal,
   LAN-only tool that must observe other apps. Revisit only if distributing.
-- The default backend host is `https://your-spark-backend.local:62419` (editable in
-  Settings).
+- The backend host is a private LAN address — set it in **Settings**, or seed it
+  from the `SPARK_BACKEND_URL` env var; the committed default is only a neutral
+  placeholder (`https://your-spark-backend.local`).