Part of Epic #3351 — mobile client support (iOS + Android via Tauri 2).

Problem

Once #3345 produces signed .aab / .ipa artifacts, getting them into testers' and users' hands still requires per-store distribution work that is mostly compliance, not code. This issue tracks that work end-to-end.

Apple App Store / TestFlight

One-time setup

• Apple Developer Program enrollment: $99 / year (organizational vs individual — pick organizational if librefang has an entity, individual otherwise).
• App Store Connect app record: bundle id ai.librefang.app, name "LibreFang", primary category "Productivity" or "Developer Tools".
• Distribution certificate, provisioning profile (Ad Hoc + App Store), generate .p12 for CI (consumed by Add iOS/Android build jobs to release.yml with signing secrets #3345).
• Privacy policy URL — required, must list every data-collection point. Draft from scratch and host at librefang.ai/privacy-mobile.
• App Privacy questionnaire in App Store Connect: declare "API key" as user-input contact info, "agent conversation logs" as user content. Mark "Data Not Linked to User" since librefang doesn't tie data to an Apple ID.

TestFlight (beta)

• Internal Testing group (up to 100 emails, no review needed) — for the LibreFang team.
• External Testing group (up to 10,000 emails, requires a one-time Beta App Review, ~24h turnaround) — for early users.
• Each TestFlight build expires in 90 days — set up a CI cadence (monthly?) so the beta channel stays alive.

App Store (production)

• Full App Review on first submission. Common rejection reasons for "AI assistant" apps:
  • Missing demo credentials: reviewers can't reach a real daemon. Provide a test daemon URL + API key in the App Review notes.
  • Sign-in Wall: apps requiring a connection upfront need a clear explanation in the review notes — connecting to user's own daemon is the entire product.
  • Encryption export compliance: librefang uses TLS — declare "uses standard encryption" (ITSAppUsesNonExemptEncryption = false in Info.plist if only standard, or fill the form once).
• Screenshots: 6.7" and 5.5" iPhone, optionally iPad (skip if not supporting iPad initially). Generate via simulator with xcrun simctl.
• Localizations: ship English only on first submission; add 中文 in a follow-up.

Google Play

One-time setup

• Play Console account: $25 one-time fee.
• App record: package ai.librefang.app, default language English.
• Upload key (separate from app signing key when using Play App Signing — recommended). The app signing key Google holds is the one users see; you keep the upload key locally + in CI as ANDROID_KEYSTORE_B64.
• Privacy policy URL (same as iOS).
• Data Safety form: identical content to Apple's privacy questionnaire.
• Content rating questionnaire (Productivity / Tools, no objectionable content).

Internal Testing → Closed Testing → Production

• Internal Testing: up to 100 testers by email, no review, deploys in minutes — librefang team channel.
• Closed Testing: tester opt-in lists, light review — early users.
• Open Testing: public beta — defer until product is solid.
• Production: full review (~3 days first time, faster on updates).
• Pre-launch reports: Play runs the .aab on a fleet of real devices and reports crashes — read these reports before each production push.

Versioning

Both stores require monotonically increasing build numbers. Map from our existing vYYYY.M.D-beta.N pre-release format:

• iOS CFBundleVersion = YYYYMMDDNN
• Android versionCode = YYYYMMDDNN (same scheme, fits in int32 until 2147)
• Display version = repo Cargo.toml workspace version

Codify the mapping in a CI step so neither store rejects a build for a version regression.

Tasks

1. Apple Developer Program enrollment — track cost in docs/operations.md if applicable.
2. Privacy policy draft + host at librefang.ai/privacy-mobile.
3. App Store Connect app record + bundle id reservation.
4. Play Console account + app record + upload-key generation.
5. Generate signing artifacts; populate #3345 secrets.
6. CI step: derive build number / versionCode from current date.
7. First TestFlight upload + Internal Testing group invitation for librefang team.
8. First Internal Testing track on Play.
9. Document the release-train SOP in docs/operations/mobile-release.md: when to push to beta, when to promote to production, who signs off.

Acceptance criteria

• App Store Connect record exists, bundle ai.librefang.app reserved.
• Play Console record exists, package ai.librefang.app reserved.
• Privacy policy live at the documented URL.
• First successful TestFlight build distributed to the internal team; one team member confirms the install + connect-wizard flow on a real iPhone.
• First successful Play Internal Testing track distributed; one team member confirms install + connect-wizard on a real Android device.
• docs/operations/mobile-release.md documents the upload + version-bump SOP.
• Both stores have CI secrets configured for unattended uploads (TestFlight via xcrun altool / Transporter, Play via r0adkll/upload-google-play@v1).

Depends on #3345 producing artifacts. This is the slowest issue in the series — App Review and Play Pre-launch Reports are not under our control. Budget two weeks of calendar time even if engineering work is ~3 days.