B4: Native courier app via Craft

Part of #1.

• config/mobile.ts: ios + android blocks with geolocation, backgroundLocation, keepAwake, pushNotifications; url mode pointing at the deployed courier routes + fallbackWebAssets
• Foreground: watchPosition -> ping endpoint. Background: startRecording (native, survives restarts); on resume drain readRecording() and POST to the backfill endpoint (cursor = last-sent timestamp)
• Permission UX via NativePermissionButton (location then locationAlways); secureStorage for the courier token; push for offer notifications
• Build: buddy build:ios / buddy build:android (xcodegen; manual Xcode compile). Use craft-native from npm (0.0.79) - the pantry copy is stale
• Verify on simulator/device: background recording + backfill roundtrip

Position streaming is built and the native shell is configured. What is not done is the device build itself, which needs Xcode on this machine.

The console now streams. It could show a delivery but never report where the courier was: the tracking page only moved when the simulator ran. Two paths behind one switch:

• Browser: watchPosition, which stops the moment the tab is backgrounded.
• Native: the bridge's background recording, drained on a timer and handed over in batches when signal returns, which covers most of a delivery.

Both feed POST /api/courier/{id}/ping (live) and /pings (batch), and both go through the framework's recordCourierPing rather than into courier_pings directly, so a fix advances the route and the estimate instead of only moving a dot.

Details that matter more than they look:

• A batch replays oldest first. Sent newest-first it walks the courier backwards through their own delivery. Verified: a three-position batch sent out of order leaves the courier at the newest fix.
• The cursor advances only once the server has the batch. Advanced on send, it loses exactly the batch that failed on the flaky connection this feature exists for.
• A partly bad batch is accepted for the good half. One wild accuracy reading should not discard the only record of a delivery nobody was watching.
• 0,0 is refused: a phone with no fix reports Null Island, and an island in the Gulf of Guinea on a courier's track is worse than a gap in it.
• Sharing is its own switch, separate from being on shift. A courier can be on shift while walking to their bike, and a phone reporting a position nobody asked for is a phone somebody turns off.

config/mobile.ts is now the courier app rather than the scaffold's defaults: a shell around /courier with geolocation, backgroundLocation, keepAwake and pushNotifications, secure storage for the courier token, and fallbackWebAssets so a courier in an underground car park gets an app that says it has no signal rather than a blank web view.

Still open: buddy build:ios / build:android and a device or simulator run to prove the background recording round-trips. That is a toolchain step (xcodegen, then a manual Xcode compile) rather than more code.