[codex] harden iOS ATS release configuration

[jjoonleo]

Summary

• Remove the blanket iOS ATS arbitrary-load allowance from the shipping Runner plist.
• Add a debug-only iOS plist that preserves HTTP support for current debug API workflows.
• Require HTTPS REST_API_URL for iOS release builds and reject release plists that enable arbitrary ATS loads.

Why

Issue #388 calls out that production iOS builds should not ship with a global ATS bypass. The release API already uses HTTPS, while debug currently targets an HTTP endpoint, so this keeps development working without weakening production/profile builds.

Validation

• plutil -lint ios/Runner/Info.plist ios/Runner/Info-Debug.plist
• plutil -lint ios/Runner.xcodeproj/project.pbxproj
• Verified ATS exists only in ios/Runner/Info-Debug.plist
• Exercised ios/scripts/extract_dart_defines.sh for missing REST_API_URL, HTTP REST_API_URL, and HTTPS REST_API_URL
• Exercised ios/scripts/validate_release_info_plist.sh against strict and debug ATS plists
• git diff --check
• flutter analyze

Closes #388

[github-actions]

Visit the preview URL for this PR (updated for commit eaacd74):

https://ontime-c63f1--pr403-codexd-issue-388-ios-psf4hdes.web.app

_{(expires Thu, 14 May 2026 08:36:39 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 7d60a2eae4c4a5839220ed6a57552a3b61cce5a3}

[github-actions]

Visit the preview URL for this PR (updated for commit eaacd74):

https://on-time-front-widgetbook--pr403-codexd-issue-388-ios-dhv0cpl1.web.app

_{(expires Thu, 14 May 2026 08:37:22 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: e53128a376fed0209d449279de9c0d94c83cdd8b}