Kiosk: selective HA iOS upstream fixes (WebSocket, lifecycle, auth, WebView)

[jaipur2001]

Scope

Selective upstream backports onto the existing Kiosk branch (no upstream merge).

• Fix WebSocket disconnects with Home Assistant 2026.10 (bump Starscream and HAKit) home-assistant/iOS#6038: HAKit 0.4.18 -> 0.4.19; Starscream -> 9f793f7; pin project and SwiftPM manifests to address WebSocket disconnects under HA 2026.10.
• Redirect web view to root on unavailable or disallowed navigation home-assistant/iOS#5985: Recover to configured frontend root on malformed/HTTP 403, 404 or 410 navigations, avoiding retry loops on a failing root.
• Stop re-sending tokens the server rejected home-assistant/iOS#6012: Stop retrying refresh tokens that Home Assistant already rejected, add localization and unit tests.
• Fix frontend stuck on launch screen after loading in the background home-assistant/iOS#6034: Defer config/get, connection-status, frontend/loaded external-bus messages while backgrounded and deliver on foreground scene activation. This fork predates upstream's scene lifecycle hooks, so bridge with UIScene notifications, preserving the fork's existing empty-state/reconnect management and watchdog.
• Fix top space reserved in full screen on iPad home-assistant/iOS#6008: Fix iPadOS full-screen top inset and status-bar strip, retaining window-control spacing for windowed iPad scenes.

Safeguards

• kiosk-main remains unchanged until CI and real-device doorbell/kiosk tests are accepted.
• No modifications to camera, audio-session, notification payloads, signing profiles or kiosk-specific doorbell code.
• Added upstream-specific unit coverage for refresh token rejection, URL recovery, foreground external-bus replay and iPad full-screen behavior.

Validation before merge

• GitHub CI lint, Xcode build, unit tests
• Wake after background/foreground and test external-bus reconnect
• HA restart: dashboard and doorbell dialog without Home-button workaround
• Camera/RTSP/MJPEG + microphone/backchannel; app audio and notification MP3
• iPad full-screen/kiosk no status strip
• 10+ minute WebSocket stability, then prolonged soak
• Signed kiosk IPA via the dedicated workflow_dispatch only after checks

Upstream PR references: home-assistant#6038, home-assistant#5985, home-assistant#6012, home-assistant#6034, home-assistant#6008.

[jaipur2001]

CI note: lint currently fails in yamllint --strict . on pre-existing line-length/trailing-space errors in .github/workflows/kiosk_ipa.yml (unchanged by this PR). This prevents the downstream SwiftLint/SwiftFormat steps from running; it does not establish a failure of the selective upstream backports. The Xcode test job runs independently. The signing workflow was intentionally left untouched.

[jaipur2001]

CI investigation (2026-10-12): run 38225631862 successfully executed 4,482 iOS unit tests with 0 failures. The job then failed with xcodebuild exit 70 because the Apple Watch Series 11 (46mm) watchOS simulator is not installed on the xcode-27 runner. The watch snapshot suite was not executed; this is not an iOS-app regression. Commit 7a38217 now conditionally runs WatchApp snapshots only if that exact simulator is available, and emits a visible warning/step summary otherwise. The production kiosk-main branch is unchanged; real iPad doorbell, AV, and HA-restart validation remain outstanding.

[github-actions]

Test coverage of this pull request is below 90%

The unit tests run 84.10% of the lines this pull request
adds or changes (164 of 195 coverable lines).

The per-file breakdown, and the changed lines no test runs, are in the
job summary. Adding tests for those lines and pushing dismisses this
review automatically.

Lines that carry no executable code, and files the unit test targets do not
build, are not counted. If the new code genuinely cannot be unit tested, a
maintainer can dismiss this review.

Patch coverage is now 91.28%, at or above the 90% threshold.