feat: authorize iOS Hermes accounts and secure session isolation

docs/PROJECT_STATUS.md

@@ -6,6 +6,57 @@ Reusable implementation, testing, device and deployment lessons are in
 [ENGINEERING_LEARNINGS.md](ENGINEERING_LEARNINGS.md). September 12 test/install
 results below are historical evidence, not a September 19 health check.
 
+## Authorized Hermes migration — 2026-10-01
+
+The direct user request supersedes the historical Qwen/client-model direction below.
+This repository now implements server-account login (`/api/auth/login`), bearer
+verification (`/api/auth/me`), logout (`/api/auth/logout`), and authorized `/token`
+bootstrap. Hermes is server-managed: model settings, pickers and control messages
+were removed. No backend source, deployment, live endpoint or secrets were touched
+in this iOS implementation.
+
+- Bearers live in device-only, unlocked Keychain items scoped to canonical HTTPS
+  origin; passwords are never persisted. Login accepts numeric Unix expiry and
+  ISO8601 expiry, and ready/provisioning accounts.
+- Logout and origin replacement invalidate auth work, cancel bootstrap and
+  disconnect transport before removing the account UI. Each account/root gets
+  fresh drafts/tasks and history scoped to origin + immutable user id; the global
+  legacy `voice_history` is never imported.
+- Signaling is same-origin WSS `/livekit` for all hosts, including IPv6/private
+  addresses. Userinfo/query/fragment origins are rejected. There is no plaintext
+  fallback and no trust-all delegate. HTTP retains the existing exact LAN pin;
+  **the LiveKit SDK's separate WSS trust may require an installed trusted CA**.
+  Self-signed WSS, actual login, multi-user server isolation, microphone capture,
+  audible speech and interruptions require subsequent user hardware qualification.
+- `assistant-progress` working/completed/failed events display request activity
+  without polluting eventual normal transcripts. Payload logging is removed; SDK
+  log level is error rather than release debug.
+- Offline UI uses fake auth and memory token storage plus isolated preferences;
+  bootstrap fixtures cannot contact a remote server. Live suite is excluded from
+  this validation. `project.yml` generates sources and an explicit test scheme.
+
+Verification: simulator build passed. Initial offline unit run: **50 passed, 0
+failed** (5 new focused authentication tests), `/tmp/hermes-ios-unit2.xcresult`.
+A scheme-less first test attempt failed before running tests; adding the generated
+scheme fixed it. Combined offline run: **51 unit + 5 UI passed, 0 failures** at
+`/tmp/hermes-ios-offline-final.xcresult`. Expanded run added the logout/account-switch
+privacy UI test, which passed; one existing URL normalization assertion raced the
+asynchronous save render and failed. It now waits for the saved confirmation before
+asserting the normalized value. A subsequent accessibility-size Activity empty-state
+assertion timed out after 5 seconds; its wait now allows 15 seconds. Both failed-run
+bundles are retained (`/tmp/hermes-ios-offline-qualified.xcresult` and
+`/tmp/hermes-ios-offline-release.xcresult`). Final focused re-verification:
+**51 unit + 3 UI passed, 0 failures**, including accessibility-size navigation,
+settings persistence/normalization and logout/account-switch transcript/task privacy,
+`/tmp/hermes-ios-focused-final.xcresult`. Remaining three offline UI cases passed in
+both expanded runs. Parent security review identified transient `/me` outages clearing
+Keychain prematurely; fixed to clear only 401/403 and added a regression test.
+Final source: **52 unit passed, 0 failures**, `/tmp/hermes-ios-unit-final.xcresult`.
+All six offline UI cases have passed across the runs described above; the final
+three focused cases passed together. No claim of one fully green expanded six-UI
+run is made. These are client-only simulator claims, not live/deployment/hardware
+qualification.
+
 ## Current direction
 
 Keep **Qwen 2.5**. The user explicitly canceled the earlier request to switch to