Mobile companion app + paired-device backend

New iOS-first companion (Expo SDK 54 + NativeWind v4) with three tabs:
Captures (the hero — floating gold mic, live mic-meter waveform,
expand-row playback), Generate (profile picker + speak + autoplay +
recent), and Voices (searchable profile list).

Pairing (V0): backend mints a one-time token, mobile scans/pastes the
voicebox:// URL, server returns a long-lived bearer it stores only as a
SHA-256 hash. Bearer-or-loopback auth applied to every user-data router
so binding 0.0.0.0 doesn't leak existing endpoints. Loopback callers
(the desktop app) keep their friction-free access.

Desktop Settings → Mobile pane: live host picker (LAN / Tailscale auto-
detected via the App-bundle binary path on macOS), QR rendering,
5-minute expiry countdown, copyable URL fallback, paired-device list
with revoke. Auto-closes when a new device pairs.

just dev now binds the backend to 0.0.0.0 so paired phones can reach
it — and just setup-python pins mlx-audio==0.4.1 + mlx-lm so fresh
Apple Silicon worktrees get a working STT path on first install.

mobile/src/lib/pairing.ts

@@ -0,0 +1,20 @@
+// Parsers for the voicebox:// pair URL scheme. The desktop UI generates
+// these as QR codes; the mobile app accepts them via QR scan or manual paste.
+
+export type PairPayload = {
+  host: string;
+  token: string;
+};
+
+const SCHEME_RE = /^voicebox:\/\/pair\?(.+)$/;
+
+export function parsePairUrl(input: string): PairPayload | null {
+  const trimmed = input.trim();
+  const match = trimmed.match(SCHEME_RE);
+  if (!match) return null;
+  const params = new URLSearchParams(match[1]);
+  const host = params.get('host');
+  const token = params.get('token');
+  if (!host || !token) return null;
+  return { host, token };
+}