iOS: iPX opens with no connection (#435)

A WKWebView runs no service worker unless the app lists its domains
in WKAppBoundDomains and the web view limits itself to them. So the
Info.plist lists ipodderx.sdf1.net, with Cloudflare Access's
(rays-sdf1.cloudflareaccess.com) and Authentik's (authentik.sdf1.net)
hosts so signing in still works. For a server in that list the web
view is made app-bound and #389's worker runs: the page and its lists
open offline from the second launch, since the first only installs the
worker.

The costs:
- Navigation elsewhere is refused, and the failure looked like the
  server being down. decidePolicyFor sends such links to Safari.
- With the key present, WebKit cuts the bridge for any server not in
  the list. That server then gets the page with its own audio, not
  the phone's player.

The web view is made again when the server changes, since being
app-bound is fixed when it is made.

A debug build adds localhost through a build script, so the simulator
can test against a page served on the Mac; the release archive's plist
was checked to have only the three. Tested in the simulator: opened
twice online, the server stopped, relaunched, and the page came up from
the worker. With the bridge still up on the app-bound host, the
phone's player played.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ios/README.md

@@ -29,6 +29,24 @@ Shake the phone to change it. Plain `http://` only on your own network
 that follows, through Cloudflare Access or ipx's own form; the cookies that leaves are what the
 player uses (`CookieBridge`). `-ipx.server <url>` as a launch argument overrides it for a run. `-ipx.noBadgePrompt YES` skips the badge permission dialog, which covers the page in a simulator run nobody is there to tap.
 
+### Opening with no connection
+
+The page's service worker, which keeps iPX readable offline in a browser (#389), runs in the app
+only for a server in `WKAppBoundDomains` in `project.yml` (#435): `ipodderx.sdf1.net`, with
+Cloudflare Access's and Authentik's hosts for signing in. For those the web view is app-bound, and
+iPX opens without a connection from the second launch on (the first installs the worker). What
+that costs:
+
+* The web view goes nowhere outside the list. A link to anywhere else opens in Safari; an
+  embedded player from another site in an item's text may not load.
+* A server not in the list still opens, but WebKit then cuts the bridge, so the page plays its own
+  audio: no lock screen, no CarPlay, nothing kept on the phone. That includes the LAN address.
+  Another server means adding it to the list (ten at most) and building again.
+* Signing in that leaves those hosts, through another identity provider, opens in Safari and does
+  not come back. Add its host too.
+
+A debug build adds `localhost`, so a simulator can test the worker against a page served on the Mac.
+
 ## Player token
 
 The player normally rides on the web view's cookie, which ends with Cloudflare Access's session.
@@ -95,11 +113,6 @@ its own clock, so both happen while the page is frozen. Video stays in the page.
 
 ## Not yet
 
-* Episodes kept on the phone (#425) play with no connection, from files the app fetches with a
-  background `URLSession` (`Offline.swift`, `EpisodeStore.swift`); a place or a finish reached
-  offline waits in `Outbox.swift` until the connection is back. But the page itself does not open
-  without a connection: a `WKWebView` runs no service worker without App-Bound Domains (#435). So
-  keep what you want, open the app while online, and it plays on with the connection gone.
 * Without the player token the cookie is the only credential: when Cloudflare Access's expires
   mid-drive, playback stops with "Sign in again", and opening the app signs in.
 * CarPlay's dashboard app needs Apple's entitlement first; then it is a second scene over the same