feat(mobile): finalize XPREM OTA config with real app id and certificate

Server registration is complete: app id 9a66f3c2-fda7-416f-87e2-6db833b32e9d,
real code-signing certificate (public half), staging/production channels
mapped server-side. Drops the app-id placeholder guard (cert guard stays) and
re-includes certificate.pem past the root *.pem ignore rule, which had been
silently excluding it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/mobile/app.config.js

@@ -23,11 +23,10 @@ const OTA_SERVER_URL = 'https://ota.apps.jbrunton.co.uk';
 const OTA_MANIFEST_URL = `${OTA_SERVER_URL}/manifest`;
 
 /**
- * XPREM application UUID, shown in the XPREM dashboard under App Info.
- * PLACEHOLDER until the update server deployment reports the real value.
+ * XPREM application UUID for Sauci, shown in the XPREM dashboard under App
+ * Info. Not a secret; overridable for pointing a build at another app.
  */
-const OTA_APP_ID_PLACEHOLDER = 'REPLACE_WITH_XPREM_APP_ID';
-const OTA_APP_ID = process.env.XPREM_APP_ID || OTA_APP_ID_PLACEHOLDER;
+const OTA_APP_ID = process.env.XPREM_APP_ID || '9a66f3c2-fda7-416f-87e2-6db833b32e9d';
 
 /** Public code-signing certificate downloaded from the XPREM dashboard. */
 const CODE_SIGNING_CERTIFICATE_PATH = './certs/certificate.pem';
@@ -50,14 +49,6 @@ const releaseChannel = process.env.RELEASE_CHANNEL || 'development';
 const codeSigningDisabled = Boolean(process.env.DISABLE_CODE_SIGNING);
 
 function assertUpdateConfigIsReal() {
-  if (OTA_APP_ID === OTA_APP_ID_PLACEHOLDER) {
-    throw new Error(
-      `RELEASE_CHANNEL=${releaseChannel} requires a real XPREM app id. ` +
-        'Set XPREM_APP_ID, or replace the placeholder in apps/mobile/app.config.js. ' +
-        'See docs/mobile-ota.md.',
-    );
-  }
-
   const certificatePath = path.join(__dirname, CODE_SIGNING_CERTIFICATE_PATH);
   const certificate = fs.existsSync(certificatePath)
     ? fs.readFileSync(certificatePath, 'utf8')

apps/mobile/certs/.gitignore

@@ -1,3 +1,6 @@
 # The update-signing private key belongs to the XPREM server, never to the app.
 private-key.pem
 *.key
+# The public certificate must be committed despite the root *.pem rule: the
+# expo-updates plugin embeds it into every build.
+!certificate.pem

apps/mobile/certs/certificate.pem

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIICzTCCAbWgAwIBAgIJAPrPjxnUOGisMA0GCSqGSIb3DQEBCwUAMBAxDjAMBgNV
+BAMTBVNhdWNpMB4XDTI2MDgzMDE4MTAzMFoXDTM2MDgzMDE4MTAzMFowEDEOMAwG
+A1UEAxMFU2F1Y2kwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDWiUac
+8i9bIbNZjv8iunVr6kqlgb9vea98JHz/A83biyszg0+GpmLYsr4zV2F7A6RitiIx
+SOML+wVedyD0F2quWccBGXinvMAds0TxgIOjQfP+8+VJ/duDjveHvn+OFW4s7XxW
+SY7TK1ufDcPWo/f5XzfqtBveug49zv3/F3MwfmMUbEY/zvH7nayPGJNuSyf3wISn
+JIt0BsHNhWykRXCzjaF2fy3nAebOyezbtbapCjUlxPENVtBCzBQ7C9kaQXCBw5mV
+hxhJlOxHWXpHJgDLHpev8A/CWQRh67tsevjKi6R6SDlf0R0xSbDJTElx8goWOOQW
+VO9aDqI+oH0KpWfnAgMBAAGjKjAoMA4GA1UdDwEB/wQEAwIHgDAWBgNVHSUBAf8E
+DDAKBggrBgEFBQcDAzANBgkqhkiG9w0BAQsFAAOCAQEAyUc20bIRCxoBTJg84mPl
+2nFDWSaAfzgo0K0b6x2T1suuq4LAOUgzBqJISrQAALd0besK1qUZSAMhjQu1wPZT
+MHuWRMxQHfOkyHMYUfOoPMS4bE+4K0WjzfoVt3y1A+oxhcIAQUUGyNgNmebfEN07
+JlX0B8UI8aIMjyfpsIDgZx1piHKwittGy/V4MPOLbmT2BBwS9BELcmWE4CwWbfeo
+JM4lXY0hk3M/GTstRYaUKiwBWEU+z1PdAmWAgrtxpVnXN+oaToWh0WbVkbF1K6r5
+3oBGFTL7kT+Wogg9GK04XoAREw0jZJ/k77oJx68lGVBNiB+Ue2KqX0H/0cf2CslY
+Ug==
+-----END CERTIFICATE-----