refactor(mobile): reuse shared transport and permission logic

[richardsolomou]

Problem

Mobile maintains parallel MCP and skills transports, while desktop and mobile also make separate pending-prompt and permission-presentation decisions. These duplicate implementations can drift in endpoint behavior and user-visible task semantics.

Changes

Route mobile MCP marketplace, installation, OAuth, tool approval, and team-skill queries through the authenticated API client used by desktop, removing the duplicate transport modules.

Centralize pending-prompt retention, ordering, recovery selection, and key formatting in core. Share plan-content extraction plus permission classification, metadata, custom-input behavior, rejection selection, and initial approval choice across desktop and native renderers. Host-specific persistence and rendering remain separate.

How did you test this?

• Core test suite (2,637 tests) and focused permission tests
• Core and UI typechecks
• Mobile test suite (338 tests) and focused plan-approval tests
• Biome on changed files
• Host-boundary check

The focused desktop PlanApprovalSelector test could not collect because the restored workspace is missing its existing tslib runtime dependency; the UI package typecheck passes.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

---

Created with PostHog Code

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit a5ab234.}