testflight: declare encryption-exempt + fix wrangler [assets] table ordering

- Info.plist: add ITSAppUsesNonExemptEncryption=false. Loopsy only uses
  iOS-standard TLS for relay traffic (exempt under US export rules), so
  every uploaded build was sitting in MISSING_EXPORT_COMPLIANCE until we
  flipped the toggle in ASC. Declaring it in the plist skips the prompt
  on future uploads.
- wrangler.toml: move workers_dev = true above [assets]. TOML scopes any
  bare key under the most recent [table] header, so [assets] was
  silently swallowing workers_dev and disabling the *.workers.dev URL.

Author: Amos N.

apps/mobile/ios/Runner/Info.plist

@@ -51,5 +51,7 @@
 	<true/>
 	<key>UIApplicationSupportsIndirectInputEvents</key>
 	<true/>
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<false/>
 </dict>
 </plist>

packages/relay/wrangler.toml

@@ -3,17 +3,19 @@ main = "src/index.ts"
 compatibility_date = "2025-04-01"
 compatibility_flags = ["nodejs_compat"]
 
+# Keep the *.workers.dev URL alive in addition to the custom domain — paired
+# phones from the pre-loopsy.dev era keep their connections working.
+workers_dev = true
+
 # Static assets (web client font files). Cloudflare matches assets first
 # before invoking the Worker, so /fonts/* short-circuits to the woff2 file
 # without touching our fetch handler. Everything else (WS, /app, /pair, etc.)
-# falls through to src/index.ts as before.
+# falls through to src/index.ts as before. Keep this block AFTER any
+# top-level keys (workers_dev, etc.) — TOML scopes everything below a
+# [table] header into that table.
 [assets]
 directory = "./public"
 
-# Keep the *.workers.dev URL alive in addition to the custom domain — paired
-# phones from the pre-loopsy.dev era keep their connections working.
-workers_dev = true
-
 [vars]
 # 1-hour ceiling on pair-token TTL. Long enough to scan a QR comfortably,
 # short enough that a leaked URL (screenshot, screen-share, paste-into-chat)