mobile: App Store submission readiness — privacy manifest gaps, Connect answers, UGC review notes

Part of #79. Not a code task — the submission work that a building app still needs.

Privacy manifest is deliberately incomplete

config/mobile.ts declares what the app provably collects, and the generated PrivacyInfo.xcprivacy carries all three:

• NSPrivacyCollectedDataTypeEmailAddress — accounts
• NSPrivacyCollectedDataTypeOtherUserContent — reviews, comments, judge responses
• NSPrivacyCollectedDataTypePhotosorVideos — ReviewPhoto uploads

all linked: true, none tracking, tracking: false overall (bench has no analytics SDK and no ad network).

accessedApiTypes is intentionally absent. Apple requires a declared reason code for certain APIs (UserDefaults, file timestamps, disk space, active keyboards). Which of those the generated Xcode project and the WebView actually touch needs reading rather than guessing, and inventing reason codes is worse than leaving the key out. Someone has to read the generated project and fill it in.

App Store Connect answers must match the manifest

App Review compares the two, and a manifest that declares less than the privacy labels is a rejection. The labels need filling in to agree with the three types above.

Review notes this app specifically needs

bench publishes user reviews about named public officials. That attracts scrutiny under the UGC guidelines (1.2), and the submission should state plainly:

• Reviews are moderated before publication — there is a flag queue and a moderation surface
• There is a reporting path and a takedown route (see #53, #51)
• Judges can respond to reviews about them (JudgeResponse)
• The judge directory itself is public-record data from CourtListener, not user-authored

Related open issues that reviewers' questions will land on: #54 (policy surface, ToS assent, DMCA), #53 (judicial-privacy removal path), #51 (moderation queue).

Remaining mechanics

• accessedApiTypes completed from the actual generated project
• App Store Connect privacy answers entered and cross-checked against PrivacyInfo.xcprivacy
• Screenshots for every required device size
• IOS_APP_VERSION / IOS_BUILD_NUMBER driven by CI rather than the '1.0.0' / '1' defaults in config/mobile.ts
• Icon reviewed at small sizes — it is currently rendered from logo.svg, which was drawn for the web header, not for a 60pt home-screen tile
• Export compliance (the app makes https requests only)