Foundation: Add mobile dependencies and service environment configuration #5

Objective

Prepare the mobile project for authentication, chess logic, and Socket.IO development so every Week 1 contributor uses the same dependencies and configuration.

Why this is needed

Several Week 1 tasks require SecureStore, Socket.IO, and chess position handling. Installing these dependencies in one PR prevents package-lock conflicts across six branches.

Server URLs must also come from environment configuration instead of being hardcoded inside components.

Required work

• Install the Expo-compatible version of expo-secure-store.
• Install socket.io-client.
• Install chess.js.
• Add validated environment configuration for:
  • EXPO_PUBLIC_API_BASE_URL
  • EXPO_PUBLIC_CHESS_SOCKET_URL
  • EXPO_PUBLIC_STOCKFISH_SOCKET_URL
• Update .env.example with safe local examples.
• Update the environment documentation.
• Ensure preview and production HTTP URLs require HTTPS.
• Ensure preview and production socket URLs require WSS.
• Reject URLs containing credentials, query strings, or fragments.
• Do not commit real credentials, tokens, or staging secrets.

Acceptance criteria

• All three dependencies are installed and recorded in package-lock.json.
• All three environment variables are validated centrally.
• Missing or invalid variables produce understandable errors.
• Components do not need to read process.env directly.
• .env.example contains no secrets.
• Environment tests cover valid and invalid configurations.
• Local-development documentation explains every variable.
• All required checks pass.

Required checks

• npm run format:check
• npm run lint
• npm run typecheck
• npm test -- --runInBand

Non-goals

• Do not add real staging credentials.
• Do not implement API requests.
• Do not implement authentication.
• Do not connect to Stockfish or live chess.