用 Cursor 后台代理做上架就绪检查：并行任务，以 pull request 形式审查

{
  "install": "npm ci",
  "terminals": [
    {
      "name": "web",
      "command": "npm run dev -- --port 3000",
      "description": "Dev server. Check changed routes here at 390 px and 320 px width."
    }
  ],
  "ports": [
    { "name": "web app", "port": 3000 }
  ]
}

## Native app (WebViewGold)
This web app also ships as iOS and Android apps. WebViewGold loads
https://app.example.com in a native WebView; every deploy is live in both apps.
- Detect the app only with isNativeApp() (user agent contains "MyAppNative").
- Native features are URL schemes from https://www.webviewgold.com/llms-full.txt.
  Never invent one; always keep a web fallback.
- Store invariants: real /privacy and /terms; in-app account deletion (server-side);
  Sign in with Apple next to any social login; no external checkout for digital
  goods in the iOS app; loading, empty and error states; layout works at 320 px.

## Cloud agents
- One task per agent. Touch only the files the task needs. If you must edit a
  shared layout file, say so at the top of the PR description.
- Run npm run lint, npm test and npm run build before you push.
- Check every route you changed in the browser at 390 px and 320 px and describe
  what you saw in the PR.
- PR description: what changed, how you verified it, open questions, and what
  needs a test on a real iPhone and Android phone.
- You cannot run the native app. Never claim you tested on iOS or Android.

# Store review rules
This app ships as iOS and Android apps via WebViewGold (native WebView around our URL).

Flag as a bug:
- New fixed or sticky UI without env(safe-area-inset-*) padding.
- Tap targets smaller than 44 x 44 px, or hover-only interactions.
- OAuth opened via window.open, target="_blank" or a popup.
- A native URL scheme (registerpush://, shareapp://, bioauth:// ...) called without
  an isNativeApp() check or without a web fallback.
- Purchase or upgrade buttons for digital goods that link to an external checkout
  inside the native app.
- Removing or breaking /privacy, /terms, /delete-account or the Delete account action.
- Data fetching without loading, empty and error states.
- Secrets or service-role keys in client-side code.

Ignore: styling preferences, naming, and refactors that do not change behavior.