Phase 1 foundation: backend, web profile, and mobile app

Greenfield implementation of CardClaws Phase 1 across three surfaces.

Backend (Rust/Axum workspace, 67 tests):
- cardclaws-types/config/db/auth/api/wallet crates
- Auth: register, login + lockout, magic link, refresh rotation, Apple verify
- Cards: CRUD, tier-limited publish, duplicate, public handle lookup
- Assets: R2 presigned uploads; vCard export
- Apple Wallet .pkpass pipeline (PKCS#7 signer behind apple-signing feature)
- Analytics ingest + summary with daily-salted IP hashing
- Migrations 0001 (incl. cardclaws_sessions) + 0002 analytics

Web profile (Astro SSR): cardclaws.com/[handle] hero + flip, contact actions,
client-built vCard, visit attribution. Verified end-to-end.

Mobile (Expo SDK 51): auth, card list/create, builder v1 (bg/text/logo,
palette, undo/redo), Skia/Reanimated viewer (flip + ambient). 22 logic tests.

CI: policy/backend/profile/mobile jobs; LOC + no-placeholder lint.

Review fixes baked in: `back` (not `cardclaws`) key; strip image is a bundled
manifest file (not a URL); sessions table added; NFC reframed; test doubles
allowed for external services.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

cardclaws-mobile/__tests__/unit/qrGenerator.test.ts

@@ -0,0 +1,25 @@
+import { qrMatrix } from "../../src/engine/renderer/qrGenerator";
+
+describe("qrGenerator", () => {
+  it("produces a non-empty square matrix", () => {
+    const m = qrMatrix("https://cardclaws.com/omar");
+    expect(m.length).toBeGreaterThan(0);
+    expect(m.every((row) => row.length === m.length)).toBe(true);
+  });
+
+  it("encodes a finder pattern in the top-left corner", () => {
+    // Every QR code has a 7x7 finder pattern at (0,0): dark border, light ring,
+    // dark 3x3 core.
+    const m = qrMatrix("hello");
+    expect(m[0].slice(0, 7).every((d) => d)).toBe(true); // top row dark
+    expect(m[1][0]).toBe(true);
+    expect(m[1][1]).toBe(false); // inner light ring
+    expect(m[3][3]).toBe(true); // dark core
+  });
+
+  it("longer payloads need a larger matrix", () => {
+    const small = qrMatrix("a");
+    const large = qrMatrix("x".repeat(300));
+    expect(large.length).toBeGreaterThan(small.length);
+  });
+});