fix(ios): restore ATS protections

[CompleteDotTech]

Summary

• restore ATS protections in the shipping native iOS app
• retain the narrow local-network allowance used for localhost and Tailscale IP connections
• upgrade explicit HTTP MagicDNS URLs to HTTPS before they reach ATS
• add regression coverage for the shipping plist and URL normalization

Root cause

The native app's Info.plist set NSAllowsArbitraryLoads to true, globally disabling App Transport Security. It also accepted explicit insecure .ts.net URLs that ATS correctly rejects once the global bypass is removed.

Validation

• node scripts/mobile-tailscale-native.test.mjs
• pnpm lint
• Native iOS simulator build not run: Xcode is unavailable on this Windows host.

Deferred

Windows MSI signing remains blocked on acquiring a code-signing certificate and repository secrets; this PR intentionally does not change that distribution item.

Refs #3807

[CompleteDotTech]

@BunsDev, this draft PR is ready for testing. Please run the documented macOS iOS simulator xcodebuild test validation and report the result here. The Windows host checks already passed; this is the remaining native XCTest coverage.

[CompleteDotTech]

@BunsDev This PR is ready to merge after testing.