ci(mobile): add EAS-based release workflow for the mobile app

- .github/workflows/mobile-release.yml: validate (npm ci + tsc) on every
  run with no secrets, plus an EAS Build job gated on workflow_dispatch or
  a `mobile-v*` tag. Requires only the EXPO_TOKEN secret.
- app/eas.json: development / preview (iOS simulator, no Apple account) /
  production (signed, EAS-managed Apple credentials) build profiles.

.github/workflows/mobile-release.yml

@@ -0,0 +1,102 @@
+name: Mobile Release
+
+# Builds the Handler mobile app (app/) with EAS Build.
+#
+# Secrets required for the `build` job:
+#   EXPO_TOKEN  - an Expo access token (https://expo.dev/settings/access-tokens)
+#
+# Apple credentials:
+#   - The `preview` profile builds an iOS *simulator* app and needs NO Apple account.
+#   - The `production` profile builds a signed .ipa and requires a paid Apple
+#     Developer Program membership. Those certificates are managed and stored by
+#     EAS (authorize once with `eas credentials`) — they are NOT uploaded here.
+
+on:
+  workflow_dispatch:
+    inputs:
+      platform:
+        description: Platform to build
+        type: choice
+        options: [ios, android, all]
+        default: ios
+      profile:
+        description: EAS build profile
+        type: choice
+        options: [preview, production]
+        default: preview
+  push:
+    # Cut a release by pushing a tag like `mobile-v1.0.0`.
+    tags:
+      - 'mobile-v*'
+
+defaults:
+  run:
+    working-directory: app
+
+jobs:
+  # Always-on validation. Needs no secrets and no Apple account.
+  validate:
+    name: Validate (install + typecheck)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: app/package-lock.json
+      - name: Install dependencies
+        run: npm ci
+      - name: Typecheck
+        run: npx tsc --noEmit
+
+  # Cloud build via EAS. Requires the EXPO_TOKEN secret.
+  build:
+    name: EAS Build
+    needs: validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Ensure EXPO_TOKEN is configured
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+        run: |
+          if [ -z "$EXPO_TOKEN" ]; then
+            echo "::error::EXPO_TOKEN secret is not set. Add it under" \
+                 "Settings → Secrets and variables → Actions before running a build." >&2
+            exit 1
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: app/package-lock.json
+
+      - uses: expo/expo-github-action@v8
+        with:
+          eas-version: latest
+          token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Resolve build parameters
+        id: params
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            echo "platform=all"        >> "$GITHUB_OUTPUT"
+            echo "profile=production"  >> "$GITHUB_OUTPUT"
+          else
+            echo "platform=${{ github.event.inputs.platform }}" >> "$GITHUB_OUTPUT"
+            echo "profile=${{ github.event.inputs.profile }}"   >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: EAS build
+        run: |
+          eas build \
+            --platform "${{ steps.params.outputs.platform }}" \
+            --profile "${{ steps.params.outputs.profile }}" \
+            --non-interactive \
+            --no-wait

app/eas.json

@@ -0,0 +1,24 @@
+{
+  "cli": {
+    "version": ">= 12.0.0",
+    "appVersionSource": "local"
+  },
+  "build": {
+    "development": {
+      "developmentClient": true,
+      "distribution": "internal"
+    },
+    "preview": {
+      "distribution": "internal",
+      "ios": {
+        "simulator": true
+      }
+    },
+    "production": {
+      "autoIncrement": true
+    }
+  },
+  "submit": {
+    "production": {}
+  }
+}