Backlog, tests, logo compression, security audit, App Store icon

- BACKLOG.md: P0-P3 roadmap incl. govuk API switch (blocked on credentials)
- APPSTORE.md: review-gate analysis (2 blockers: LAN data source, Always-location notes)
- SECURITY.md: audit - no secrets, no ATS holes, one MEDIUM (relay IP in binary, planned fix)
- FuelBoardTests/: SPM package, 28 tests on real Shared/ sources (sanitizer, price guard, RAG, sort, distance, brands)
- Logos: proper 2x/3x pairs, palette-quantized, 75% smaller (315KB -> 79KB)
- App icon: 1024px fuelpump on gradient (was missing entirely -> instant rejection)
- decodeStations(from:) exposed for testability; relay fetch reuses it

FuelBoardTests/Package.swift

@@ -0,0 +1,23 @@
+// swift-tools-version: 5.9
+import PackageDescription
+
+let package = Package(
+    name: "FuelBoardShared",
+    platforms: [.macOS(.v13)],
+    products: [
+        .library(name: "FuelBoardShared", targets: ["FuelBoardShared"])
+    ],
+    targets: [
+        // Compiles the REAL app sources via symlinks into Shared/ — tests
+        // exercise production code, not a copy.
+        .target(
+            name: "FuelBoardShared",
+            path: "Sources/FuelBoardShared"
+        ),
+        .testTarget(
+            name: "FuelBoardSharedTests",
+            dependencies: ["FuelBoardShared"],
+            path: "Tests/FuelBoardSharedTests"
+        ),
+    ]
+)