Add iOS TestFlight CI via Codemagic

Set up automated cloud iOS builds and TestFlight distribution without a
local Mac:
- Add codemagic.yaml: iOS->TestFlight workflow with automatic signing,
  build-number auto-increment, triggered by the vX.Y.Z release tags.
- Set the iOS bundle identifier to net.oott-security.app (was the
  placeholder com.example.frontend).
- Set the iOS display name to OOTT.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

codemagic.yaml

@@ -0,0 +1,74 @@
+# Codemagic CI/CD configuration for OOTT.
+#
+# Builds the Flutter iOS app on a cloud macOS machine and publishes it to
+# TestFlight. No local Mac is required.
+#
+# Triggered automatically by the `vX.Y.Z` git tags that `release.sh` pushes,
+# so cutting a release also ships a new TestFlight build. Can also be run
+# on demand via the "Run build" button in the Codemagic UI.
+#
+# SECRETS: none live in this repo. The App Store Connect API key (.p8, Key ID,
+# Issuer ID) is stored in Codemagic's encrypted credential store and referenced
+# here only by integration name. Signing certificates and provisioning profiles
+# are fetched on the build machine at build time and discarded with it.
+#
+# One-time setup required in the Codemagic UI before the first build:
+#   1. Add an App Store Connect integration (upload the .p8, Key ID, Issuer ID)
+#      and put its name in `integrations.app_store_connect` below.
+#   2. Create an environment variable group named `appstore_connect` containing
+#      APP_STORE_APP_ID = the numeric Apple ID of the app record in
+#      App Store Connect.
+
+workflows:
+  ios-testflight:
+    name: iOS TestFlight
+    instance_type: mac_mini_m2
+    max_build_duration: 60
+    working_directory: frontend
+    integrations:
+      # Replace with the name of the App Store Connect integration configured
+      # in the Codemagic UI.
+      app_store_connect: OOTT App Store Connect
+    environment:
+      flutter: stable
+      xcode: latest
+      cocoapods: default
+      groups:
+        - appstore_connect            # provides APP_STORE_APP_ID (not a secret)
+      vars:
+        BUNDLE_ID: "net.oott-security.app"   # not secret; ships inside every app
+    triggering:
+      events:
+        - tag
+      tag_patterns:
+        - pattern: "v*"               # matches the vX.Y.Z tags release.sh pushes
+          include: true
+    scripts:
+      - name: Set up automatic code signing
+        script: |
+          keychain initialize
+          app-store-connect fetch-signing-files "$BUNDLE_ID" \
+            --type IOS_APP_STORE \
+            --create
+          keychain add-certificates
+          xcode-project use-profiles
+      - name: Get Flutter packages
+        script: flutter pub get
+      - name: Run frontend tests
+        script: flutter test
+      - name: Build IPA
+        script: |
+          # Each TestFlight upload needs a unique, increasing build number.
+          BUILD_NUMBER=$(($(app-store-connect get-latest-testflight-build-number "$APP_STORE_APP_ID") + 1))
+          flutter build ipa --release \
+            --build-number=$BUILD_NUMBER \
+            --export-options-plist=/Users/builder/export_options.plist
+    artifacts:
+      - build/ios/ipa/*.ipa
+      - /tmp/xcodebuild_logs/*.log
+    publishing:
+      app_store_connect:
+        auth: integration
+        submit_to_testflight: true
+        beta_groups:
+          - Internal Testers