Use a reverse-domain redirect scheme for the native app

- Android/iOS now return to cat.ikerdemo.musify:/callback instead of
  musify://callback: a private-use scheme based on a domain we own
  (RFC 8252 section 7.1), so another app is unlikely to claim it.
- The Musify Native app no longer needs devMode: loopback and custom
  scheme redirects are both valid for a native app.
- zitadel-init also updates an existing app's config, so the change
  reaches instances created before it (the client id is kept).
- iOS takes the scheme from everything before the first ':', since the
  new URI has a single slash.

mobile/composeApp/src/commonMain/kotlin/com/musify/app/Config.kt

@@ -9,7 +9,8 @@ package com.musify.app
  * `nativeRedirectUri` is the OAuth redirect registered for the "Musify
  * Native" Zitadel app (see deploy/compose.yml, zitadel-init): a fixed
  * loopback port on Desktop (RFC 8252 native-app loopback flow), and the
- * `musify://callback` custom scheme on Android/iOS.
+ * `cat.ikerdemo.musify:/callback` reverse-domain custom scheme on Android/iOS
+ * (RFC 8252 §7.1: based on a domain we own, so no other app plausibly claims it).
  */
 expect object AppConfig {
     val apiBaseUrl: String

mobile/composeApp/src/commonMain/kotlin/com/musify/app/auth/BrowserAuthLauncher.kt

@@ -12,7 +12,7 @@ package com.musify.app.auth
  *  - Desktop: a one-shot loopback HTTP server on the fixed port registered in
  *    Zitadel (RFC 8252 §7.3), opened via the OS default browser.
  *  - Android: Chrome Custom Tabs; the redirect is caught by
- *    [AuthCallbackActivity] via the `musify://callback` intent filter.
+ *    [AuthCallbackActivity] via the `cat.ikerdemo.musify:/callback` intent filter.
  *  - iOS: `ASWebAuthenticationSession`, which owns the whole round trip.
  */
 expect class BrowserAuthLauncher() {