feat(ios): a sideloadable iOS client over the shared Rust engine

A SwiftUI app that drives the same UniFFI engine as Android: Rust owns the
Proton sessions, SQLite and every decrypted byte, and Swift asks it questions
off the main thread. Playback goes through MPVKit's libmpv, with the pstr://
stream protocol ported from the Android JNI half, and secrets live in the
Keychain.

scripts/build-ios.sh builds the static library for aarch64-apple-ios, writes
the Swift bindings (module PstrBridge), generates the Xcode project with
XcodeGen and packages an unsigned .ipa for SideStore or AltStore, which
re-sign it with the viewer's own Apple ID. The generated project, Info.plist
and build output are ignored.

ios/ProtonStream/Bridge/ProtonStream-Bridging-Header.h

@@ -0,0 +1,4 @@
+// C declarations Swift sees without a module import: the UniFFI scaffolding
+// generated beside PstrBridge.swift, and the stream ABI UniFFI does not cover.
+#include "PstrBridgeFFI.h"
+#include "pstr_stream.h"

ios/ProtonStream/Bridge/pstr_stream.h

@@ -0,0 +1,21 @@
+// The blocking stream ABI exported by crates/pstr-android (`lib.rs`,
+// `pstr_android_stream_*`). It is not part of the UniFFI interface on purpose:
+// decrypted bytes go straight from Rust into libmpv's buffer and never pass
+// through Swift values.
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+/// Read up to `length` bytes at `offset` into `buffer`. Returns the byte count,
+/// 0 at end of file, or -1 on failure or cancellation.
+int64_t pstr_android_stream_read(uint64_t handle, uint64_t offset, void *buffer, size_t length);
+
+/// The stream's size in bytes, or -1 for an unknown handle.
+int64_t pstr_android_stream_size(uint64_t handle);
+
+/// Interrupt the read in flight for this stream, if any.
+void pstr_android_stream_cancel(uint64_t handle);
+
+/// Drop the registry's reference. Call exactly once per published handle.
+void pstr_android_stream_release(uint64_t handle);