Phase 1 foundation: backend, web profile, and mobile app

Greenfield implementation of CardClaws Phase 1 across three surfaces.

Backend (Rust/Axum workspace, 67 tests):
- cardclaws-types/config/db/auth/api/wallet crates
- Auth: register, login + lockout, magic link, refresh rotation, Apple verify
- Cards: CRUD, tier-limited publish, duplicate, public handle lookup
- Assets: R2 presigned uploads; vCard export
- Apple Wallet .pkpass pipeline (PKCS#7 signer behind apple-signing feature)
- Analytics ingest + summary with daily-salted IP hashing
- Migrations 0001 (incl. cardclaws_sessions) + 0002 analytics

Web profile (Astro SSR): cardclaws.com/[handle] hero + flip, contact actions,
client-built vCard, visit attribution. Verified end-to-end.

Mobile (Expo SDK 51): auth, card list/create, builder v1 (bg/text/logo,
palette, undo/redo), Skia/Reanimated viewer (flip + ambient). 22 logic tests.

CI: policy/backend/profile/mobile jobs; LOC + no-placeholder lint.

Review fixes baked in: `back` (not `cardclaws`) key; strip image is a bundled
manifest file (not a URL); sessions table added; NFC reframed; test doubles
allowed for external services.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

cardclaws-backend/crates/cardclaws-db/migrations/0002_analytics.sql

@@ -0,0 +1,28 @@
+-- 0002_analytics.sql — raw event log and hourly rollups (PRD §9.3 / §18).
+-- Added in B2 so the analytics write path (B4) has a home before week 7.
+
+CREATE TABLE analytics_events (
+    id          BIGSERIAL PRIMARY KEY,
+    card_id     UUID NOT NULL REFERENCES cards(id) ON DELETE CASCADE,
+    event_type  TEXT NOT NULL,
+    share_token TEXT REFERENCES share_links(token),
+    -- SHA-256(ip + per-day salt). Never raw IP (§18.3).
+    ip_hash     TEXT,
+    country     TEXT,
+    city        TEXT,
+    user_agent  TEXT,
+    occurred_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX idx_analytics_card_time ON analytics_events(card_id, occurred_at DESC);
+
+CREATE TABLE analytics_rollups_hourly (
+    card_id     UUID NOT NULL REFERENCES cards(id) ON DELETE CASCADE,
+    hour        TIMESTAMPTZ NOT NULL,
+    visits      INTEGER NOT NULL DEFAULT 0,
+    qr_scans    INTEGER NOT NULL DEFAULT 0,
+    nfc_taps    INTEGER NOT NULL DEFAULT 0,
+    saves       INTEGER NOT NULL DEFAULT 0,
+    link_clicks INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (card_id, hour)
+);