Add iPad support, auto-pinning, and comprehensive logging

- Adaptive iPhone/iPad layout with NavigationSplitView sidebar
- Auto-detect SSL-pinned domains, fall back to passthrough
- Certificate install via local HTTP server (Safari profile flow)
- App Group-backed CA, per-domain leaf cert LRU cache
- DB-backed config repository, Darwin notification throttling
- Rules engine, breakpoint rules, pinned domain tracking
- os.Logger instrumentation across tunnel/proxy/mitm/capture/cert/rules/db/ipc/ui
- Fix dyld framework embed, race conditions, thread safety

ProxyCore/Sources/Shared/AppGroupPaths.swift

@@ -0,0 +1,23 @@
+import Foundation
+
+public enum AppGroupPaths {
+    public static var containerURL: URL {
+        if let groupURL = FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: ProxyConstants.appGroupIdentifier) {
+            return groupURL
+        }
+
+        return FileManager.default.urls(for: .documentDirectory, in: .userDomainMask)[0]
+    }
+
+    public static var certificatesDirectory: URL {
+        containerURL.appendingPathComponent("Certificates", isDirectory: true)
+    }
+
+    public static var caCertificateURL: URL {
+        certificatesDirectory.appendingPathComponent("proxy_ca.der")
+    }
+
+    public static var caPrivateKeyURL: URL {
+        certificatesDirectory.appendingPathComponent("proxy_ca_privatekey.raw")
+    }
+}