Harden iOS app with audit fixes, UI consistency, and sheet race condition fixes

Applies verified fixes from deep audit (concurrency, performance, security,
accessibility), standardizes CRUD form buttons to Add/Save pattern, removes
.drawingGroup() that broke search bar TextFields, and converts vulnerable
.sheet(isPresented:) + if-let patterns to safe presentation to prevent
blank white modals.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

iosApp/CaseraQLThumbnail/ThumbnailProvider.swift

@@ -54,13 +54,17 @@ class ThumbnailProvider: QLThumbnailProvider {
         }), nil)
     }
 
+    /// Lightweight struct to detect the package type via Codable instead of JSONSerialization
+    private struct PackageTypeEnvelope: Decodable {
+        let type: String?
+    }
+
     /// Detects the package type by reading the "type" field from the JSON
     private func detectPackageType(at url: URL) -> PackageType {
         do {
             let data = try Data(contentsOf: url)
-            if let json = try JSONSerialization.jsonObject(with: data) as? [String: Any],
-               let typeString = json["type"] as? String,
-               typeString == "residence" {
+            let envelope = try JSONDecoder().decode(PackageTypeEnvelope.self, from: data)
+            if envelope.type == "residence" {
                 return .residence
             }
         } catch {