Fix EAS local builds and resolve require cycles

- Add dotenv-cli for EAS local builds to load env vars
- Break circular dependencies in store/hooks imports
- Add env var validation with clear error messages
- Remove hardcoded Sentry auth token from sentry.properties
- Add .ipa files to .gitignore

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/mobile/src/lib/authErrorHandler.ts

@@ -1,6 +1,7 @@
 import { router } from "expo-router";
 import { supabase } from "./supabase";
-import { useAuthStore } from "../store";
+// Import directly from authStore to avoid circular dependency with store/index.ts
+import { useAuthStore } from "../store/authStore";
 
 /**
  * Handles authentication errors from edge function calls.

apps/mobile/src/lib/mediaCache.ts

@@ -0,0 +1,22 @@
+/**
+ * Media Cache Utilities
+ *
+ * Extracted from useDecryptedMedia to avoid circular dependencies.
+ * This module handles caching of decrypted media files.
+ */
+
+import { cleanupDecryptedMedia } from './encryption';
+
+// In-memory cache to avoid re-decrypting the same media
+export const decryptedMediaCache = new Map<string, string>();
+
+/**
+ * Clears all cached decrypted media files from disk and memory.
+ * Call this on sign out to free up storage.
+ */
+export async function clearDecryptedMediaCache(): Promise<void> {
+  for (const uri of decryptedMediaCache.values()) {
+    await cleanupDecryptedMedia(uri);
+  }
+  decryptedMediaCache.clear();
+}

apps/mobile/src/lib/supabase.ts

@@ -47,10 +47,26 @@ const ExpoStorageAdapter = {
     },
 };
 
-const supabaseUrl = process.env.EXPO_PUBLIC_SUPABASE_URL!;
-const supabaseAnonKey = process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY!;
+const supabaseUrl = process.env.EXPO_PUBLIC_SUPABASE_URL;
+const supabaseAnonKey = process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY;
 
-export const supabase = createClient(supabaseUrl, supabaseAnonKey, {
+// Validate environment variables at startup (skip in test environment where mocks handle this)
+const isTestEnv = process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID !== undefined;
+if (!isTestEnv && (!supabaseUrl || !supabaseAnonKey)) {
+    const missing = [];
+    if (!supabaseUrl) missing.push('EXPO_PUBLIC_SUPABASE_URL');
+    if (!supabaseAnonKey) missing.push('EXPO_PUBLIC_SUPABASE_ANON_KEY');
+    const errorMsg = `Missing required environment variables: ${missing.join(', ')}. App cannot start.`;
+    console.error('[Supabase]', errorMsg);
+    // In production, this will be caught by Sentry before crashing
+    throw new Error(errorMsg);
+}
+
+// Use dummy values in test environment (supabase-js is mocked anyway)
+const finalUrl = supabaseUrl || (isTestEnv ? 'https://test.supabase.co' : '');
+const finalKey = supabaseAnonKey || (isTestEnv ? 'test-key' : '');
+
+export const supabase = createClient(finalUrl, finalKey, {
     auth: {
         storage: ExpoStorageAdapter,
         autoRefreshToken: true,