feat: App mobile Expo + API mobile dédiée

memento-mobile/ (Expo + React Native + expo-router):
- Auth: login email/password → Bearer token (expo-secure-store)
- Layout: guard auth → redirect /(auth)/login ou /(tabs)/home
- Tabs: Accueil, Carnets, Recherche, Profil
- Screens: login, home (recent notes + quick actions), notebooks list,
  note viewer (WebView HTML), search (texte), notebook detail, profile
- Design: tokens brand-accent (#A47148), ink, concrete, paper, border
- lib/config.ts: API_URL dev/prod configurable
- lib/api.ts: apiFetch avec Bearer token automatique
- lib/store.ts: Zustand auth store (login/logout/restore)

memento-note/ (API mobile dédiée):
- lib/mobile-auth.ts: createMobileToken / verifyMobileToken (HMAC-SHA256, 90j)
- POST /api/mobile/auth/login: email+password → token + user
- GET /api/mobile/auth/me: valider token, retourner profil
- GET /api/mobile/notebooks: liste carnets avec nb notes
- GET /api/mobile/notes: notes récentes (filtre par carnet optionnel)
- GET /api/mobile/notes/[id]: contenu complet d'une note
- GET /api/mobile/search: recherche fulltext titre+contenu

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

memento-mobile/lib/api.ts

@@ -0,0 +1,27 @@
+import * as SecureStore from 'expo-secure-store'
+
+const TOKEN_KEY = 'memento_token'
+
+export async function getToken(): Promise<string | null> {
+  return SecureStore.getItemAsync(TOKEN_KEY)
+}
+
+export async function setToken(token: string): Promise<void> {
+  await SecureStore.setItemAsync(TOKEN_KEY, token)
+}
+
+export async function clearToken(): Promise<void> {
+  await SecureStore.deleteItemAsync(TOKEN_KEY)
+}
+
+export async function apiFetch(url: string, options: RequestInit = {}): Promise<Response> {
+  const token = await getToken()
+  return fetch(url, {
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      ...options.headers,
+    },
+  })
+}

memento-mobile/lib/config.ts

@@ -0,0 +1,18 @@
+// API base URL — change for dev/prod
+export const API_URL = __DEV__
+  ? 'http://192.168.1.190:3000'   // local network dev server
+  : 'https://memento-note.com'
+
+export const ENDPOINTS = {
+  login: `${API_URL}/api/mobile/auth/login`,
+  logout: `${API_URL}/api/mobile/auth/logout`,
+  me: `${API_URL}/api/mobile/auth/me`,
+  notebooks: `${API_URL}/api/mobile/notebooks`,
+  notes: (notebookId?: string) =>
+    notebookId
+      ? `${API_URL}/api/mobile/notes?notebookId=${notebookId}`
+      : `${API_URL}/api/mobile/notes`,
+  note: (id: string) => `${API_URL}/api/mobile/notes/${id}`,
+  search: `${API_URL}/api/mobile/search`,
+  dailyNote: `${API_URL}/api/notes/daily`,
+}

memento-mobile/lib/store.ts

@@ -0,0 +1,56 @@
+import { create } from 'zustand'
+import { apiFetch, setToken, clearToken, getToken } from '@/lib/api'
+import { ENDPOINTS } from '@/lib/config'
+
+interface User {
+  id: string
+  name: string | null
+  email: string
+  tier: string
+}
+
+interface AuthState {
+  user: User | null
+  loading: boolean
+  login: (email: string, password: string) => Promise<void>
+  logout: () => Promise<void>
+  restore: () => Promise<void>
+}
+
+export const useAuthStore = create<AuthState>((set) => ({
+  user: null,
+  loading: true,
+
+  login: async (email, password) => {
+    const res = await fetch(ENDPOINTS.login, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, password }),
+    })
+    if (!res.ok) {
+      const data = await res.json()
+      throw new Error(data.error || 'Identifiants invalides')
+    }
+    const { token, user } = await res.json()
+    await setToken(token)
+    set({ user })
+  },
+
+  logout: async () => {
+    await clearToken()
+    set({ user: null })
+  },
+
+  restore: async () => {
+    try {
+      const token = await getToken()
+      if (!token) { set({ loading: false }); return }
+      const res = await apiFetch(ENDPOINTS.me)
+      if (!res.ok) { await clearToken(); set({ loading: false, user: null }); return }
+      const user = await res.json()
+      set({ user, loading: false })
+    } catch {
+      set({ loading: false, user: null })
+    }
+  },
+}))