Add agent instructions; extract signing/backend secrets from source

- Add AGENTS.md (canonical) + CLAUDE.md symlink + ROADMAP.md
- Move Apple Team ID from project.yml into a gitignored
  Config/Signing.xcconfig via configFiles; commit the .example template
- Replace hardcoded backend host in AppSettings with a neutral
  placeholder + SPARK_BACKEND_URL env-var fallback
- Scrub the Team ID, .local host, and raw LAN IP from README/docs
- Ignore Config/Signing.xcconfig and .env

Ten31Transcripts/Settings/AppSettings.swift

@@ -92,11 +92,19 @@ final class AppSettings: ObservableObject {
 
     private let defaults: UserDefaults
 
+    /// Neutral placeholder. The real (private LAN) backend host is never committed —
+    /// it's entered in Settings (persisted to UserDefaults) or seeded from the
+    /// `SPARK_BACKEND_URL` env var for dev/CI/harness runs.
+    static let defaultBackendURL = "https://your-spark-backend.local"
+
     init(defaults: UserDefaults = .standard) {
         self.defaults = defaults
 
+        // Precedence: a value the user saved in Settings wins; else the env var
+        // (handy when launching from Xcode/terminal); else the placeholder.
         self.backendBaseURL = defaults.string(forKey: Keys.backendBaseURL)
-            ?? "https://your-spark-backend.local:62419"
+            ?? ProcessInfo.processInfo.environment["SPARK_BACKEND_URL"]
+            ?? Self.defaultBackendURL
 
         self.skipTLSVerification = defaults.object(forKey: Keys.skipTLS) as? Bool ?? true