Backlog, tests, logo compression, security audit, App Store icon

- BACKLOG.md: P0-P3 roadmap incl. govuk API switch (blocked on credentials)
- APPSTORE.md: review-gate analysis (2 blockers: LAN data source, Always-location notes)
- SECURITY.md: audit - no secrets, no ATS holes, one MEDIUM (relay IP in binary, planned fix)
- FuelBoardTests/: SPM package, 28 tests on real Shared/ sources (sanitizer, price guard, RAG, sort, distance, brands)
- Logos: proper 2x/3x pairs, palette-quantized, 75% smaller (315KB -> 79KB)
- App icon: 1024px fuelpump on gradient (was missing entirely -> instant rejection)
- decodeStations(from:) exposed for testability; relay fetch reuses it

FuelBoard/Assets.xcassets/brand_morrisons.imageset/Contents.json

@@ -1,9 +1,14 @@
 {
   "images": [
     {
-      "filename": "brand_morrisons.png",
+      "filename": "brand_morrisons_2x.png",
       "idiom": "universal",
       "scale": "2x"
+    },
+    {
+      "filename": "brand_morrisons_3x.png",
+      "idiom": "universal",
+      "scale": "3x"
     }
   ],
   "info": {