fix(ios): restrict authentication capabilities and validate bootstrap types

Require iOS 18.4 for explicit upload denial in the isolated authentication window. Add origin-bound generated download policy, app-switcher privacy, typed metadata regressions and original community icon assets. Seven portable tests and Swift formatting checks pass; Apple SDK validation remains external.

ios/Sources/ServerMetadata.swift

@@ -0,0 +1,19 @@
+import Foundation
+
+enum ServerMetadata {
+    private struct Bootstrap: Decodable {
+        let appName: String
+        let setupRequired: Bool
+        let passwordResetEnabled: Bool
+    }
+    private struct Authentication: Decodable {
+        let enabled: Bool
+        let passwordLoginEnabled: Bool
+    }
+    static func validate(bootstrap: Data, authentication: Data) throws {
+        let decoder = JSONDecoder()
+        decoder.keyDecodingStrategy = .convertFromSnakeCase
+        _ = try decoder.decode(Bootstrap.self, from: bootstrap)
+        _ = try decoder.decode(Authentication.self, from: authentication)
+    }
+}