Add agent instructions; extract signing/backend secrets from source

- Add AGENTS.md (canonical) + CLAUDE.md symlink + ROADMAP.md
- Move Apple Team ID from project.yml into a gitignored
  Config/Signing.xcconfig via configFiles; commit the .example template
- Replace hardcoded backend host in AppSettings with a neutral
  placeholder + SPARK_BACKEND_URL env-var fallback
- Scrub the Team ID, .local host, and raw LAN IP from README/docs
- Ignore Config/Signing.xcconfig and .env

docs/01_PROJECT_BRIEF.md

@@ -135,10 +135,11 @@ Full request/response shapes, curl examples, limits, and error formats are in
 
 ## 7. Remaining open items (small)
 
-1. **Base URL — RESOLVED.** `https://your-spark-backend.local:62419`, also
-   `https://your-spark-backend.local:62419` (prefer the `.local` form; it survives IP
-   changes). Ship the `.local` host as the default; keep it editable in settings.
-   Service-discovery at `GET /api/endpoints`.
+1. **Base URL — RESOLVED.** A private LAN host — a `.local` mDNS name (preferred
+   over a raw IP, since it survives IP changes) — configured in Settings or via the
+   `SPARK_BACKEND_URL` env var, and never committed. Ship a neutral placeholder as
+   the default; keep it editable in settings. Service-discovery at
+   `GET /api/endpoints`.
 2. **Send trigger** — assume auto-POST on call end; expose a "hold for review"
    toggle if the user wants to eyeball the timeline first.
 3. **Retention** — keep the session folder after a successful hand-off, or prune