Add agent instructions; extract signing/backend secrets from source

- Add AGENTS.md (canonical) + CLAUDE.md symlink + ROADMAP.md
- Move Apple Team ID from project.yml into a gitignored
  Config/Signing.xcconfig via configFiles; commit the .example template
- Replace hardcoded backend host in AppSettings with a neutral
  placeholder + SPARK_BACKEND_URL env-var fallback
- Scrub the Team ID, .local host, and raw LAN IP from README/docs
- Ignore Config/Signing.xcconfig and .env

docs/01_PROJECT_BRIEF.md

@@ -135,10 +135,11 @@ Full request/response shapes, curl examples, limits, and error formats are in
 
 ## 7. Remaining open items (small)
 
-1. **Base URL — RESOLVED.** `https://your-spark-backend.local:62419`, also
-   `https://your-spark-backend.local:62419` (prefer the `.local` form; it survives IP
-   changes). Ship the `.local` host as the default; keep it editable in settings.
-   Service-discovery at `GET /api/endpoints`.
+1. **Base URL — RESOLVED.** A private LAN host — a `.local` mDNS name (preferred
+   over a raw IP, since it survives IP changes) — configured in Settings or via the
+   `SPARK_BACKEND_URL` env var, and never committed. Ship a neutral placeholder as
+   the default; keep it editable in settings. Service-discovery at
+   `GET /api/endpoints`.
 2. **Send trigger** — assume auto-POST on call end; expose a "hold for review"
    toggle if the user wants to eyeball the timeline first.
 3. **Retention** — keep the session folder after a successful hand-off, or prune

docs/03_DATA_CONTRACTS.md

@@ -76,12 +76,13 @@ locally — the mic track is the user's known identity / VAD source.)
 
 ## 3. SparkControl — connection (real)
 
-- **Base URL (confirmed):** `https://your-spark-backend.local:62419` — also reachable at
-  `https://your-spark-backend.local:62419` (the `.local` form survives IP changes;
-  **prefer it as the default**). Service-discovery JSON is at
+- **Base URL (confirmed):** a private LAN host — a `.local` mDNS name (preferred
+  over a raw IP; it survives IP changes) — configured in Settings or via the
+  `SPARK_BACKEND_URL` env var, and **never committed**. Service-discovery JSON is at
   `GET /api/endpoints` (returns current vLLM / Parakeet / Kokoro URLs). All audio
-  endpoints in §4–§5 hang off this base. Still **make it a setting** so the host
-  can change, but ship `https://your-spark-backend.local:62419` as the default.
+  endpoints in §4–§5 hang off this base. **Make it a setting** so the host can
+  change, and ship a neutral placeholder (`https://your-spark-backend.local`) as
+  the default.
 - **TLS:** Start9 self-signed Root CA. Either skip verification (`URLSession`
   delegate trusting the cert; curl `-k`; `rejectUnauthorized:false`) **or** install
   the Start9 Root CA into the trust store.