Auth0 sign-in + Bearer JWT path for iOS app

[ma3u]

Goal

Replace the current dev-mode x-api-key auth path with a production-quality Auth0 PKCE OAuth → Bearer JWT → Aura GraphQL Data API flow, so installers other than the dev can sign in with Apple / Google / GitHub / Microsoft (matching login.neo4j.com).

Split out of #3 — Track B (GitHub Pages) and Aura Data API deployment are done; this issue covers only the Auth0 piece, which is gated on a manual Auth0 tenant setup.

Current state

• iOS app already syncs end-to-end via dev-mode (DEV_AURA_GRAPHQL_URL + DEV_AURA_API_KEY patched into Info.plist by scripts/build_ios.sh). Verified on iPhone 17 Pro (see Apple Health Sync to Aura + In-app Dashboard #2).
• Aura GraphQL Data API live at https://0da41c11-graphql.production-orch-1326.neo4j.io/graphql with API-key auth provider only.
• iOS code already includes Auth0Client.swift (PKCE via ASWebAuthenticationSession, no SDK), AuraConnection.swift, ConnectView.swift — code is written, just not wired to real values.

Acceptance criteria

• Auth0 tenant with Apple + Google + GitHub + Microsoft social connections (per docs/AUTH_SETUP.md)
• JWKS auth provider on the Aura Data API pointing at Auth0's .well-known/jwks.json (add via aura-cli or REST)
• AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_AUDIENCE filled in ios/project.yml
• iOS app signs in with at least Apple + Google on real iPhone
• Manual curl test from AUTH_SETUP.md §7 succeeds (Bearer JWT against the Data API)
• iOS ConnectView accepts the GraphQL URL, validates with a { __typename } probe using the Bearer JWT
• ingestDay mutation succeeds against the live Data API with a Bearer JWT (not just x-api-key)

Notes

• The dev-mode x-api-key path stays as-is — it's how the dev runs the app and how the existing API-key auth provider on the Data API works. Auth0 is additive: a second auth provider on the same Data API.
• Out of scope (same as GraphQL Data API for iOS + GitHub Pages personal dashboard #3): per-user @authorization rules, Aura Management API for instance picking, Auth0 paid tier features.