fix: make release artifacts fully offline

[jjoonleo]

Summary

• replace deprecated prebuilt sodium_libs with sodium 4.0.4 native build hooks
• preserve the existing Argon2id plus XChaCha20-Poly1305 backup format and behavior
• bundle sodium.js, SQLite WASM, Drift worker, and CanvasKit locally for web
• remove Firebase Messaging service worker registration, Google Sign-In bootstrap, and remote SQLite WASM URL
• extend the local-only gate to reject remote web bootstrap resources and require local CanvasKit

Root cause

App Store Connect rejected build 1.1.0 (56) with error 91011 because the prebuilt libsodium.framework contained an arm64e slice compiled with the iOS 18.5 SDK. Xcode 26 requires arm64e slices to be built with the iOS 26 SDK or later. The official sodium 4 native-asset path compiles libsodium with the active SDK and produces an arm64-only iOS framework.

The web bootstrap also still loaded Google Sign-In, Firebase Messaging, and SQLite WASM from remote servers, which violated the product local-only boundary despite the Dart and native source gates passing.

Behavior and lifecycle

Backup creation and restore keep the same version 1 container, KDF parameters, authenticated encryption, password failure behavior, and atomic restore behavior. Native libsodium initialization is now supplied by sodium build hooks. Web startup loads every required runtime artifact from the deployed bundle and registers only the Flutter offline cache service worker.

Persistence and migration

No database, backup format, or user-data migration. Existing encrypted backups remain readable because algorithms, parameters, framing, and authenticated metadata are unchanged.

Concurrency and idempotency

Password derivation still runs through Sodium.runIsolated. Repeated dependency generation and release builds are stable. Reinstalling or updating the app does not rewrite existing local data.

Validation

• flutter test: 552 passed
• flutter analyze: no issues
• local-only boundary: passed, including iOS remote notification and web bootstrap regressions
• flutter build web --release: passed; WASM dry run passed
• built web bundle contains local sodium.js, sqlite3.wasm, Drift worker, and CanvasKit
• built web bootstrap contains no Firebase Messaging, Google Sign-In, unpkg, or remote SQLite markers
• flutter build ipa --release --export-method app-store: passed
• iOS sodium.framework is arm64 only; no framework contains arm64e
• OnTime 1.1.0 (56), bundle club.devkor.ontime.ios

Out of scope

• no backup format change
• no app version or build-number change
• no App Store metadata or production release change

Follow-up to #580 and #581.

[github-actions]

Visit the preview URL for this PR (updated for commit cafa0c2):

https://on-time-front-widgetbook--pr-582-fmwqub7i.web.app

_{(expires Tue, 01 Sep 2026 01:55:18 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: e53128a376fed0209d449279de9c0d94c83cdd8b}