feat(ios): implement SwiftUI companion with isolated WKWebView sessions

Add HTTPS onboarding, origin policy, native recovery/settings, isolated web sign-in and file export. Portable production URL policy tests pass on Linux; all Swift sources parse. Xcode build and simulator validation remain required on macOS.

ios/Tests/ServerAddressTests.swift

@@ -0,0 +1,28 @@
+import XCTest
+@testable import Yuvomi
+
+final class ServerAddressTests: XCTestCase {
+    func testCanonicalizationAndPorts() throws {
+        XCTAssertEqual(try ServerAddress(" HTTPS://Family.Example:443/ ").url.absoluteString, "https://family.example")
+        XCTAssertEqual(try ServerAddress("https://family.example:8443").url.port, 8443)
+        XCTAssertEqual(try ServerAddress("https://[::1]:8443").url.port, 8443)
+    }
+    func testUnsafeConfigurations() {
+        for value in ["http://family.example", "javascript:alert(1)", "https://u:p@family.example",
+                      "https://family.example/subpath", "https://family.example?token=secret",
+                      "https://family.example/#token", "https://family.example:0",
+                      "https://family.example:65536", "https://family.example/%2f",
+                      "https://family.example\\@evil.test", "https:///", ""] {
+            XCTAssertThrowsError(try ServerAddress(value), value)
+        }
+    }
+    func testOriginIsolation() throws {
+        let server = try ServerAddress("https://family.example")
+        XCTAssertTrue(server.owns(URL(string: "https://FAMILY.example:443/tasks?id=1")!))
+        for value in ["https://family.example.evil.test", "https://family.example@evil.test",
+                      "https://user@family.example", "http://family.example", "https://family.example:8443",
+                      "file:///etc/passwd", "data:text/html,hi"] {
+            XCTAssertFalse(server.owns(URL(string: value)!), value)
+        }
+    }
+}