Add agent instructions; extract signing/backend secrets from source

- Add AGENTS.md (canonical) + CLAUDE.md symlink + ROADMAP.md
- Move Apple Team ID from project.yml into a gitignored
  Config/Signing.xcconfig via configFiles; commit the .example template
- Replace hardcoded backend host in AppSettings with a neutral
  placeholder + SPARK_BACKEND_URL env-var fallback
- Scrub the Team ID, .local host, and raw LAN IP from README/docs
- Ignore Config/Signing.xcconfig and .env

docs/03_DATA_CONTRACTS.md

@@ -76,12 +76,13 @@ locally — the mic track is the user's known identity / VAD source.)
 
 ## 3. SparkControl — connection (real)
 
-- **Base URL (confirmed):** `https://your-spark-backend.local:62419` — also reachable at
-  `https://your-spark-backend.local:62419` (the `.local` form survives IP changes;
-  **prefer it as the default**). Service-discovery JSON is at
+- **Base URL (confirmed):** a private LAN host — a `.local` mDNS name (preferred
+  over a raw IP; it survives IP changes) — configured in Settings or via the
+  `SPARK_BACKEND_URL` env var, and **never committed**. Service-discovery JSON is at
   `GET /api/endpoints` (returns current vLLM / Parakeet / Kokoro URLs). All audio
-  endpoints in §4–§5 hang off this base. Still **make it a setting** so the host
-  can change, but ship `https://your-spark-backend.local:62419` as the default.
+  endpoints in §4–§5 hang off this base. **Make it a setting** so the host can
+  change, and ship a neutral placeholder (`https://your-spark-backend.local`) as
+  the default.
 - **TLS:** Start9 self-signed Root CA. Either skip verification (`URLSession`
   delegate trusting the cert; curl `-k`; `rejectUnauthorized:false`) **or** install
   the Start9 Root CA into the trust store.