build(ios): validate iPad and publish a private TestFlight

[Tutitoos]

Plan reference

Post-1.0 — iPhone and iPad: distribution.

Objective

Complete the adaptive iPad experience and publish a signed private TestFlight build with reproducible versioning, privacy declarations, release notes, and installation evidence.

Scope

• Finalize compact and regular layouts, multitasking, keyboard shortcuts, pointer behavior, state restoration, device matrix, icons, signing, entitlements, privacy manifest, archive, upload, tester access, crash symbol upload to self-hosted Sentry, and rollback guidance.

Tasks

• Define Swift 6 models, actors, storage, API, and UI boundaries for this scope.
• Implement the smallest complete native capability.
• Add XCTest, Swift Concurrency, migration, UI, accessibility, and device tests where applicable.
• Update generated clients, translations, privacy declarations, and distribution documentation.

Acceptance criteria

• Supported iPhone and iPad devices pass launch, authentication, inbox, search, conversation, action, compose, attachment, offline, notification, and logout smoke tests.

• Split View, Stage Manager, rotation, Dynamic Type, VoiceOver, keyboard, and pointer flows remain usable.

• The TestFlight archive, dSYM, source revision, version, build, signing identity, and release notes agree.

• Private testers can install the build without public App Store promotion.

• Account isolation, data protection, accessibility, EN default, and ES completeness match the web and macOS contracts.

• Tokens, credentials, message content, recipients, and personal data never enter logs, crash reports, screenshots, fixtures, URLs, or notification defaults.

• The capability is independently reviewable and rollback-safe.

Validation

• Run release archive, signature, entitlements, privacy manifest, symbol upload, TestFlight processing, clean install, upgrade, rollback, and physical iPhone and iPad smoke tests.

• Run Swift build, XCTest, strict concurrency checks, generated-client diff, and the affected simulator and physical-device UI tests.

• Use sanitized fixtures and protected accounts only for final manual provider validation.

Dependencies

Post-1.0 work. Blocked until Mailflow 1.0.0 is released: https://github.com/Tutitoos/mailflow/milestone/9

Risks

Offline state, background execution, notification privacy, generated contracts, and device credentials can diverge from server truth. Use actors, Keychain, bounded caches, explicit conflict states, and real-device validation.

Out of scope

• Public App Store launch, Android, paid promotion, widgets, watchOS, and visionOS.