Phase 4-5: build pipeline + device enrollment

Builder service (Mac mini):
- Build worker: xcodebuild archive + export + fastlane signing + upload to unraid
- /api/build/upload (source archive) and /api/build/git (clone) ingest paths
- SSE-streamed build logs, builds list UI, live status updates
- /api/devices/from-enrollment bridge endpoint (shared-secret auth)

Storefront (unraid):
- /enroll/ public flow: landing page, mobileconfig generator, callback parser
- Forwards extracted UDIDs to the Mac mini builder for ASC registration
- docker-compose.yml now passes BUILDER_URL and BUILDER_SHARED_SECRET

Updated CLAUDE.md with full architecture, deploy flow, and gotchas.

docker-compose.yml

@@ -11,5 +11,7 @@ services:
       - SESSION_SECRET=${SESSION_SECRET}
       - BASE_URL=https://appstore.treytartt.com
       - DATA_DIR=/data
+      - BUILDER_URL=${BUILDER_URL}
+      - BUILDER_SHARED_SECRET=${BUILDER_SHARED_SECRET}
     volumes:
       - /mnt/user/downloads/ios-appstore:/data