Backlog, tests, logo compression, security audit, App Store icon

- BACKLOG.md: P0-P3 roadmap incl. govuk API switch (blocked on credentials)
- APPSTORE.md: review-gate analysis (2 blockers: LAN data source, Always-location notes)
- SECURITY.md: audit - no secrets, no ATS holes, one MEDIUM (relay IP in binary, planned fix)
- FuelBoardTests/: SPM package, 28 tests on real Shared/ sources (sanitizer, price guard, RAG, sort, distance, brands)
- Logos: proper 2x/3x pairs, palette-quantized, 75% smaller (315KB -> 79KB)
- App icon: 1024px fuelpump on gradient (was missing entirely -> instant rejection)
- decodeStations(from:) exposed for testability; relay fetch reuses it

APPSTORE.md

@@ -0,0 +1,86 @@
+# FuelBoard App Store Approval Review
+
+Review date: 2026-08-11 · Target: App Store submission readiness.
+This is the companion to SECURITY.md — focuses on App Store *review* gate
+(guideline compliance), not code security.
+
+## Status: NOT SUBMISSION-READY
+
+Two blockers remain before a real submission (see below). Everything else
+checks out for review.
+
+## Blockers
+
+### 1. Data source — LAN relay (BLOCKER)
+- The app fetches from `http://192.168.1.131:8788` — a private LAN host. Off
+  the user's network it fails and falls back to sample data. Reviewers on
+  Apple's network will see empty/sample results → 2.1 (performance) rejection,
+  and hardcoded IPs look like test builds.
+- **Fix**: the govuk API switch (BACKLOG P0). App must talk to a public HTTPS
+  endpoint before submission. The relay (HTTPS domain) or direct gov.uk OAuth
+  both work; the code path is already stubbed.
+
+### 2. Always-location justification (BLOCKER without review notes)
+- `NSLocationAlwaysAndWhenInUseUsageDescription` + `UIBackgroundModes: location`
+  present, but guideline 5.1.1 requires the feature to be obvious AND the app
+  must visibly use background location. The geofenced "cheapest station" alerts
+  satisfy this, but the reviewer must see it:
+  - Provide detailed App Review notes explaining the alert flow (enable Alerts →
+    geofence trigger → notification when approaching the cheapest station).
+  - Ensure the Alerts tab is discoverable and functional in review.
+  - Also: "Always" prompt should only appear after the user opts into alerts
+    (in-progress UX; currently the permission prompt may fire too early).
+
+## Review-relevant configuration — PASS
+
+- [x] **App icon**: was MISSING entirely (invalid-binary rejection). Fixed —
+      1024×1024 `AppIcon.appiconset` + `ASSETCATALOG_COMPILER_APPICON_NAME`.
+- [x] **Launch screen**: `UILaunchScreen` empty dict present (iOS 14+ style).
+- [x] **Device family**: iPhone-only (`TARGETED_DEVICE_FAMILY = 1`) — no iPad
+      multitasking requirements.
+- [x] **Versioning**: `CFBundleShortVersionString 1.0`, `CFBundleVersion 1`
+      (bump per release).
+- [x] **Permissions**: only location (WhenInUse + Always), with clear usage
+      strings. No contacts/photos/mic/camera.
+- [x] **No third-party SDKs** → no SDK privacy manifests or third-party
+      attribution required.
+- [x] **No account creation / login** → no account-deletion requirement (5.1.1(v)).
+- [x] **ATS**: no `NSAllowsArbitraryLoads` (raw-IP cleartext is ATS-exempt; once
+      the relay is HTTPS this is moot).
+- [x] **Export compliance**: no crypto beyond keychain/SecItem → no
+      documentation needed.
+
+## Content / IP review
+
+- **Brand logos (Shell, BP, Tesco…)**: bundled from Simple Icons (CC0) +
+  Wikimedia Commons. Nominative use (identifying stations) is standard practice
+  (cf. GasBuddy). Low risk, but keep the sources documented.
+- **Price data**: gov.uk Fuel Finder data is OGL-licensed — include attribution
+  in the app (About/credits) once live data ships. Sample fallback data must be
+  clearly demo-labelled (or removed for review) so reviewers don't think the
+  prices are fake — 2.3.1 accuracy risk.
+- **"Cheapest" claims**: data is 12h-old cache. The UI says "cheapest" — fine,
+  but a small "prices from the UK Fuel Finder dataset, updated twice daily"
+  footnote is good hygiene for 2.3.1.
+
+## Suggested review notes (copy-paste for App Store Connect)
+
+> FuelBoard shows the cheapest petrol, diesel, and premium fuel near the user
+> using the UK government Fuel Finder dataset (OGL). Prices are fetched up to
+> twice a day; the app filters 5/10/15-mile radii on-device. Location is used
+> to (a) rank stations by distance and (b) power the optional Alerts feature:
+> when enabled, the app geofences the cheapest station in the user's chosen
+> radius and sends a notification when they approach it. Always-location is
+> only requested when the user enables alerts. The app also provides a
+> home-screen widget showing the current cheapest station nearby.
+
+## Release checklist (before every submission)
+
+1. [ ] Relay/govuk data source live on a public HTTPS endpoint
+2. [ ] Always-permission flow tied to explicit user opt-in
+3. [ ] Bump `CFBundleShortVersionString` / `CFBundleVersion`
+4. [ ] Sample-data fallback labelled or removed in the release build
+5. [ ] OGL attribution present in-app
+6. [ ] `swift test` green (FuelBoardTests, 28 tests)
+7. [ ] Security audit pass (see SECURITY.md recurring checks)
+8. [ ] Icon + screenshots for all required sizes in App Store Connect