Add agent instructions; extract signing/backend secrets from source

- Add AGENTS.md (canonical) + CLAUDE.md symlink + ROADMAP.md
- Move Apple Team ID from project.yml into a gitignored
  Config/Signing.xcconfig via configFiles; commit the .example template
- Replace hardcoded backend host in AppSettings with a neutral
  placeholder + SPARK_BACKEND_URL env-var fallback
- Scrub the Team ID, .local host, and raw LAN IP from README/docs
- Ignore Config/Signing.xcconfig and .env

project.yml

@@ -7,17 +7,20 @@ options:
   createIntermediateGroups: true
   groupSortPosition: top
 
+# Signing identity (DEVELOPMENT_TEAM) is kept out of source in a gitignored xcconfig
+# so the Team ID isn't committed. Copy Config/Signing.xcconfig.example to
+# Config/Signing.xcconfig and set your team. Keeping the value stable is what makes
+# macOS TCC grants (Mic / Screen Recording / Accessibility) persist across rebuilds.
+configFiles:
+  Debug: Config/Signing.xcconfig
+  Release: Config/Signing.xcconfig
+
 settings:
   base:
     MARKETING_VERSION: "0.1.0"
     CURRENT_PROJECT_VERSION: "1"
     SWIFT_VERSION: "5.0"
     CODE_SIGN_STYLE: Automatic
-    # Grant's free personal team (cert OU). Baked in so `xcodegen generate` keeps
-    # a STABLE signing identity across regenerations — macOS ties TCC permission
-    # grants (Mic / Screen Recording / Accessibility) to this identity, so a
-    # stable team is what makes those permissions persist across rebuilds.
-    DEVELOPMENT_TEAM: "BK4Y6CXN35"
 
 targets:
   Ten31Transcripts: