Phase 4-5: build pipeline + device enrollment

Builder service (Mac mini):
- Build worker: xcodebuild archive + export + fastlane signing + upload to unraid
- /api/build/upload (source archive) and /api/build/git (clone) ingest paths
- SSE-streamed build logs, builds list UI, live status updates
- /api/devices/from-enrollment bridge endpoint (shared-secret auth)

Storefront (unraid):
- /enroll/ public flow: landing page, mobileconfig generator, callback parser
- Forwards extracted UDIDs to the Mac mini builder for ASC registration
- docker-compose.yml now passes BUILDER_URL and BUILDER_SHARED_SECRET

Updated CLAUDE.md with full architecture, deploy flow, and gotchas.

.env.example

@@ -12,3 +12,7 @@ BASE_URL=https://appstore.example.com
 
 # Port
 PORT=3000
+
+# Mac mini builder bridge (used by /enroll/callback to forward UDIDs)
+BUILDER_URL=http://10.3.3.192:3090
+BUILDER_SHARED_SECRET=changeme-same-as-builder-env