Add native iOS app with App Store preparation

iOS app (ios/, SwiftUI, iOS 17+) in the web UI's styling with the Kamon
logo. It covers everything the web interface does except password, API
tokens and backups: dashboard, peers with search and filter, peer detail
with traffic charts, add/edit peers, one-time config with QR code and
share sheet, server settings with apply bar, app settings, data
retention and log viewer.

- Pairing by QR code or pasted pairing code; token kept in the keychain;
  self-signed certificates are pinned by SHA-256 fingerprint.
- Colour providers and logo drawing are nonisolated: SwiftUI's background
  renderer calls them, and main-actor closures crashed there when the
  camera scanner was open.
- App Store: version 1.0, export compliance, privacy manifest, app icon,
  release.sh (archive and upload), listing text, review notes and 6.9"
  screenshots in ios/AppStore.

Server:
- Full-access API tokens may use settings, logs and restart; password,
  tokens, backup/restore and the admin username stay admin-only.
- Web pairing dialog gains "Copy pairing code".
- The development simulator reports health checks in Linux wording.

Claude-Session: https://claude.ai/code/session_01RAnLbyQZ5ZTA7KqwXP98nw

app.js

@@ -1008,7 +1008,9 @@
               h('div', { class: 'notice' }, 'The token is shown only now. Only a hash is stored on the server.'),
               h('div', { class: 'qrrow' },
                 h('img', { class: 'qr', src: r.qr, alt: 'Pairing QR code' }),
-                h('div', { class: 'col' }, h('button', { type: 'button', class: 'btn', onClick: () => copy(r.token) }, 'Copy token'))),
+                h('div', { class: 'col' },
+                  h('button', { type: 'button', class: 'btn', onClick: () => copy(r.pairing) }, 'Copy pairing code'),
+                  h('button', { type: 'button', class: 'btn', onClick: () => copy(r.token) }, 'Copy token'))),
               h('pre', { class: 'code' }, r.token),
               h('div', { class: 'foot' }, h('button', { type: 'button', class: 'btn primary', onClick: close }, 'Done')));
             reloadTokens();