feat: pre-launch UX overhaul (mobile/Flutter) — full audit, Waves 0–3

apps/mobile-flutter/ios/Runner.xcodeproj/project.pbxproj

@@ -491,6 +491,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
+				CODE_SIGN_ENTITLEMENTS = Runner/Runner.entitlements;
 				PRODUCT_BUNDLE_IDENTIFIER = com.khoivo.nham;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_OBJC_BRIDGING_HEADER = "Runner/Runner-Bridging-Header.h";
@@ -673,6 +674,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
+				CODE_SIGN_ENTITLEMENTS = Runner/Runner.entitlements;
 				PRODUCT_BUNDLE_IDENTIFIER = com.khoivo.nham;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_OBJC_BRIDGING_HEADER = "Runner/Runner-Bridging-Header.h";
@@ -695,6 +697,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
+				CODE_SIGN_ENTITLEMENTS = Runner/Runner.entitlements;
 				PRODUCT_BUNDLE_IDENTIFIER = com.khoivo.nham;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_OBJC_BRIDGING_HEADER = "Runner/Runner-Bridging-Header.h";

apps/mobile-flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard

@@ -19,7 +19,7 @@
                             <imageView opaque="NO" clipsSubviews="YES" multipleTouchEnabled="YES" contentMode="center" image="LaunchImage" translatesAutoresizingMaskIntoConstraints="NO" id="YRO-k0-Ey4">
                             </imageView>
                         </subviews>
-                        <color key="backgroundColor" red="1" green="1" blue="1" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                        <color key="backgroundColor" red="0.99607843137254903" green="0.98431372549019602" blue="0.96470588235294119" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
                         <constraints>
                             <constraint firstItem="YRO-k0-Ey4" firstAttribute="centerX" secondItem="Ze5-6b-2t3" secondAttribute="centerX" id="1a2-6s-vTC"/>
                             <constraint firstItem="YRO-k0-Ey4" firstAttribute="centerY" secondItem="Ze5-6b-2t3" secondAttribute="centerY" id="4X2-HB-R7a"/>

apps/mobile-flutter/ios/Runner/Runner.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.developer.applesignin</key>
+	<array>
+		<string>Default</string>
+	</array>
+</dict>
+</plist>

apps/mobile-flutter/lib/data/api_client.dart

@@ -15,11 +15,14 @@ import 'dart:convert';
 
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:http/http.dart' as http;
+import 'package:supabase_flutter/supabase_flutter.dart' show Session;
 
 import '../models/streaming.dart';
 import '../services/supabase_service.dart';
 import 'env.dart';
 
+const _authRefreshSkew = Duration(minutes: 5);
+
 /// Client-side mirror of the server `ApiError` envelope.
 ///
 /// Re-implemented (not imported) exactly as the RN client does, because the
@@ -40,7 +43,8 @@ class ApiError implements Exception {
   ]);
 
   @override
-  String toString() => 'ApiError($code, $status, retryable=$retryable): $message';
+  String toString() =>
+      'ApiError($code, $status, retryable=$retryable): $message';
 }
 
 /// Parse a `Retry-After` header: numeric seconds first, else HTTP-date delta.
@@ -96,33 +100,45 @@ class StreamAnalyzeInput {
   });
 
   Map<String, dynamic> toJson() => {
-        'message': message,
-        'loggedDate': loggedDate,
-        'timezoneOffset': timezoneOffset,
-        if (locale != null) 'locale': locale,
-      };
+    'message': message,
+    'loggedDate': loggedDate,
+    'timezoneOffset': timezoneOffset,
+    if (locale != null) 'locale': locale,
+  };
 }
 
 class ApiClient {
   ApiClient({http.Client? httpClient})
-      : _http = httpClient ?? http.Client(),
-        _baseUrl = Env.apiBaseUrl;
+    : _http = httpClient ?? http.Client(),
+      _baseUrl = Env.apiBaseUrl;
 
   final http.Client _http;
   final String _baseUrl;
 
+  bool _expiresSoon(Session session) {
+    final expiresAt = session.expiresAt;
+    if (expiresAt == null) return false;
+    final expiry = DateTime.fromMillisecondsSinceEpoch(expiresAt * 1000);
+    return DateTime.now().add(_authRefreshSkew).isAfter(expiry);
+  }
+
   /// Bearer header from the current Supabase session token, or empty when
   /// signed out. Mirrors `authHeaders()` in the RN client.
   Future<Map<String, String>> _authHeaders() async {
-    final token = SupabaseService.client.auth.currentSession?.accessToken;
+    final auth = SupabaseService.client.auth;
+    var session = auth.currentSession;
+    if (session != null && _expiresSoon(session)) {
+      try {
+        session = (await auth.refreshSession()).session ?? auth.currentSession;
+      } catch (_) {
+        session = auth.currentSession;
+      }
+    }
+    final token = session?.accessToken;
     return token != null ? {'Authorization': 'Bearer $token'} : {};
   }
 
-  Future<T> _request<T>(
-    String method,
-    String path, [
-    Object? body,
-  ]) async {
+  Future<T> _request<T>(String method, String path, [Object? body]) async {
     final headers = await _authHeaders();
     if (body != null) {
       headers['Content-Type'] = 'application/json';
@@ -158,6 +174,16 @@ class ApiClient {
   /// DELETE.
   Future<T> delete<T>(String path) => _request<T>('DELETE', path);
 
+  /// Permanently delete the signed-in user's account and all their data
+  /// (`DELETE /api/v1/account`). The server removes the Supabase auth user,
+  /// which cascades to every app row. There is no undo.
+  Future<void> deleteAccount() => delete<dynamic>('/api/v1/account');
+
+  /// Fetch a complete JSON snapshot of the user's data
+  /// (`GET /api/v1/account`): profile, meals (with items), and weights.
+  Future<Map<String, dynamic>> exportMyData() =>
+      get<Map<String, dynamic>>('/api/v1/account');
+
   /// Fire-and-forget ping to wake a scale-to-zero backend on launch. Failures
   /// are swallowed (offline / unreachable is fine). Mirrors `warmupApi()`.
   Future<void> warmup() async {
@@ -182,9 +208,10 @@ class ApiClient {
     headers['Content-Type'] = 'application/json';
     headers['Accept'] = 'text/event-stream';
 
-    final req = http.Request('POST', Uri.parse('$_baseUrl/api/analyze-meal'))
-      ..headers.addAll(headers)
-      ..body = jsonEncode(input.toJson());
+    final req =
+        http.Request('POST', Uri.parse('$_baseUrl/api/analyze-meal'))
+          ..headers.addAll(headers)
+          ..body = jsonEncode(input.toJson());
 
     http.StreamedResponse streamed;
     try {