fix(ios): restrict authentication capabilities and validate bootstrap types

Require iOS 18.4 for explicit upload denial in the isolated authentication window. Add origin-bound generated download policy, app-switcher privacy, typed metadata regressions and original community icon assets. Seven portable tests and Swift formatting checks pass; Apple SDK validation remains external.

ios/Sources/ServerProbe.swift

@@ -1,10 +1,12 @@
 import Foundation
 
 final class NoRedirect: NSObject, URLSessionTaskDelegate {
-    func urlSession(_ session: URLSession, task: URLSessionTask,
-                    willPerformHTTPRedirection response: HTTPURLResponse,
-                    newRequest request: URLRequest,
-                    completionHandler: @escaping (URLRequest?) -> Void) {
+    func urlSession(
+        _ session: URLSession, task: URLSessionTask,
+        willPerformHTTPRedirection response: HTTPURLResponse,
+        newRequest request: URLRequest,
+        completionHandler: @escaping (URLRequest?) -> Void
+    ) {
         completionHandler(nil)
     }
 }
@@ -19,16 +21,11 @@ enum ServerProbe {
         let session = URLSession(configuration: configuration, delegate: NoRedirect(), delegateQueue: nil)
         defer { session.invalidateAndCancel() }
         let version = try await json(session, server.url.appendingPathComponent("api/v1/version"))
-        guard version["app_name"] is String,
-              version["setup_required"] is Bool,
-              version["password_reset_enabled"] is Bool else { throw ConnectionError.incompatible }
         let auth = try await json(session, server.url.appendingPathComponent("api/v1/auth/oidc/config"))
-        guard auth["enabled"] is Bool, auth["password_login_enabled"] is Bool else {
-            throw ConnectionError.incompatible
-        }
+        try ServerMetadata.validate(bootstrap: version, authentication: auth)
     }
 
-    private static func json(_ session: URLSession, _ url: URL) async throws -> [String: Any] {
+    private static func json(_ session: URLSession, _ url: URL) async throws -> Data {
         var request = URLRequest(url: url)
         request.setValue("application/json", forHTTPHeaderField: "Accept")
         let (stream, response) = try await session.bytes(for: request)
@@ -38,9 +35,6 @@ enum ServerProbe {
             guard data.count < 65_536 else { throw ConnectionError.incompatible }
             data.append(byte)
         }
-        guard let result = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
-            throw ConnectionError.incompatible
-        }
-        return result
+        return data
     }
 }