fix: resolve merge conflicts with main branch

Merge origin/main into feature branch, resolving 3 conflicts:
- app/api/__init__.py: add classification_rules_router alongside new
  routers from main (audit_logs, i18n, mobile, compliance, translation)
- app/models.py: keep ClassificationRuleModel alongside new models from
  main (MobileDevice, ComplianceTemplate, PipelineRoutingRule)
- tests/conftest.py: import both ClassificationRuleModel and new models
  from main (AuditLog, ComplianceTemplate)

Also renumber migration from 027 to 037 to chain from the latest
migration on main (036_add_document_translation_fields).

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

mobile/app/(auth)/_layout.tsx

@@ -0,0 +1,17 @@
+/**
+ * Layout for the unauthenticated route group: Welcome → Login.
+ *
+ * Uses a headerless native stack so the screens animate naturally.
+ */
+
+import { Stack } from "expo-router";
+import React from "react";
+
+export default function AuthLayout() {
+  return (
+    <Stack screenOptions={{ headerShown: false }}>
+      <Stack.Screen name="index" />
+      <Stack.Screen name="login" />
+    </Stack>
+  );
+}

mobile/app/(auth)/index.tsx

@@ -0,0 +1,4 @@
+/**
+ * Welcome screen route – first screen shown to unauthenticated users.
+ */
+export { default } from "../../src/screens/WelcomeScreen";

mobile/app/(auth)/login.tsx

@@ -0,0 +1,4 @@
+/**
+ * Login screen route – server URL entry and SSO sign-in.
+ */
+export { default } from "../../src/screens/LoginScreen";

mobile/app/(tabs)/_layout.tsx

@@ -0,0 +1,72 @@
+/**
+ * Tab navigator layout for authenticated users.
+ *
+ * Registers three tabs: Upload (default), Files, and Profile.
+ * Push notifications are initialised here so they activate as soon as the
+ * user enters the authenticated area.
+ */
+
+import { Tabs } from "expo-router";
+import { Ionicons } from "@expo/vector-icons";
+import React from "react";
+import { usePushNotifications } from "../../src/hooks/usePushNotifications";
+import { useAuth } from "../../src/context/AuthContext";
+
+export default function TabLayout() {
+  const { isAuthenticated } = useAuth();
+  usePushNotifications(isAuthenticated);
+
+  return (
+    <Tabs
+      screenOptions={{
+        tabBarActiveTintColor: "#1e40af",
+        tabBarInactiveTintColor: "#9ca3af",
+        tabBarStyle: {
+          borderTopColor: "#e5e7eb",
+          backgroundColor: "#ffffff",
+        },
+        headerStyle: {
+          backgroundColor: "#1e40af",
+        },
+        headerTintColor: "#ffffff",
+        headerTitleStyle: {
+          fontWeight: "700",
+        },
+      }}
+    >
+      <Tabs.Screen
+        name="index"
+        options={{
+          title: "Upload",
+          tabBarLabel: "Upload",
+          tabBarIcon: ({ color, size }) => (
+            <Ionicons name="cloud-upload-outline" size={size} color={color} />
+          ),
+          headerTitle: "DocuElevate",
+        }}
+      />
+      <Tabs.Screen
+        name="files"
+        options={{
+          title: "Files",
+          tabBarLabel: "Files",
+          tabBarIcon: ({ color, size }) => (
+            <Ionicons name="document-text-outline" size={size} color={color} />
+          ),
+          headerTitle: "My Documents",
+        }}
+      />
+      <Tabs.Screen
+        name="profile"
+        options={{
+          title: "Profile",
+          tabBarLabel: "Profile",
+          tabBarIcon: ({ color, size }) => (
+            <Ionicons name="person-circle-outline" size={size} color={color} />
+          ),
+          headerTitle: "Profile",
+        }}
+      />
+    </Tabs>
+  );
+}

mobile/app/(tabs)/files.tsx

@@ -0,0 +1,4 @@
+/**
+ * Files tab route.
+ */
+export { default } from "../../src/screens/FilesScreen";

mobile/app/(tabs)/index.tsx

@@ -0,0 +1,4 @@
+/**
+ * Upload tab route (default tab for authenticated users).
+ */
+export { default } from "../../src/screens/UploadScreen";

mobile/app/(tabs)/profile.tsx

@@ -0,0 +1,4 @@
+/**
+ * Profile tab route.
+ */
+export { default } from "../../src/screens/ProfileScreen";

mobile/app/_layout.tsx

@@ -0,0 +1,155 @@
+/**
+ * Root layout for the DocuElevate mobile app.
+ *
+ * Wraps the entire app in AuthProvider and SafeAreaProvider, then uses the
+ * AuthGuard component to redirect between the unauthenticated (auth) route
+ * group and the authenticated (tabs) route group based on session state.
+ *
+ * ShareProvider + Linking listener: when iOS opens the app via the share
+ * sheet (CFBundleDocumentTypes) or Android via a SEND intent, the incoming
+ * file:// / content:// URL is captured and forwarded to UploadScreen via
+ * ShareContext.
+ */
+
+import * as Linking from "expo-linking";
+import { Stack, useRouter, useSegments } from "expo-router";
+import React, { useEffect } from "react";
+import { ActivityIndicator, StyleSheet, Text, View } from "react-native";
+import { SafeAreaProvider } from "react-native-safe-area-context";
+import { AuthProvider, useAuth } from "../src/context/AuthContext";
+import { ShareProvider, useShare } from "../src/context/ShareContext";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** The custom URL scheme registered in app.json. */
+const APP_SCHEME_PREFIX = "docuelevate://";
+
+/** Extract a display filename from a file:// or content:// URI. */
+function filenameFromUri(uri: string): string {
+  try {
+    const decoded = decodeURIComponent(uri);
+    // Take the last path segment and strip any query string
+    const last = decoded.split("/").pop() ?? "shared_file";
+    return last.split("?")[0] || "shared_file";
+  } catch {
+    return "shared_file";
+  }
+}
+
+/**
+ * Build a Linking URL handler that forwards incoming file:// / content://
+ * URLs to ShareContext.  Extracted as a module-level factory so the handler
+ * itself is created once and can be easily unit-tested without a React context.
+ *
+ * On iOS the Share Sheet / "Open In" action may deliver the file path under
+ * the app's custom URL scheme (`docuelevate://…/file.pdf`) instead of a plain
+ * `file://` URL.  When that happens we rewrite the URL to `file:///…` so the
+ * upload logic can read the file normally.
+ */
+function makeUrlHandler(addPendingFile: (f: { uri: string; filename: string }) => void) {
+  return ({ url }: { url: string }) => {
+    let fileUri = url;
+
+    // iOS may pass a filesystem path under the app's custom scheme.
+    // Rewrite it to a file:// URL unless it looks like an in-app deep-link
+    // (expo-router groups always start with "(").
+    if (url.startsWith(APP_SCHEME_PREFIX)) {
+      const path = url.slice(APP_SCHEME_PREFIX.length);
+      if (path.length > 0 && !path.startsWith("(")) {
+        fileUri = "file:///" + path.replace(/^\/+/, "");
+      }
+    }
+
+    if (!fileUri.startsWith("file://") && !fileUri.startsWith("content://")) return;
+    addPendingFile({ uri: fileUri, filename: filenameFromUri(fileUri) });
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Auth guard – redirects to the correct route group after auth state resolves
+// ---------------------------------------------------------------------------
+
+function AuthGuard() {
+  const { isLoading, isAuthenticated } = useAuth();
+  const { addPendingFile } = useShare();
+  const segments = useSegments();
+  const router = useRouter();
+
+  // Listen for files shared from other apps (iOS Share Sheet / Android Intent).
+  // Both cold-start (app was not running) and warm-start (app in background)
+  // cases are handled.
+  useEffect(() => {
+    const handleIncomingUrl = makeUrlHandler(addPendingFile);
+
+    // Cold start – app launched directly by a share action
+    Linking.getInitialURL().then((url) => {
+      if (url) handleIncomingUrl({ url });
+    });
+
+    // Warm start – app was already running when the share action occurred
+    const subscription = Linking.addEventListener("url", handleIncomingUrl);
+    return () => subscription.remove();
+  }, [addPendingFile]);
+
+  useEffect(() => {
+    if (isLoading) return;
+
+    const inAuthGroup = segments[0] === "(auth)";
+
+    if (!isAuthenticated && !inAuthGroup) {
+      // Unauthenticated visitor outside the auth group → send to welcome
+      router.replace("/(auth)/");
+    } else if (isAuthenticated && inAuthGroup) {
+      // Authenticated user on auth screens → send to main app
+      router.replace("/(tabs)/");
+    }
+  }, [isAuthenticated, isLoading, segments, router]);
+
+  if (isLoading) {
+    return (
+      <View style={styles.loading}>
+        <ActivityIndicator size="large" color="#1e40af" />
+        <Text style={styles.loadingText}>Loading…</Text>
+      </View>
+    );
+  }
+
+  return (
+    <Stack screenOptions={{ headerShown: false }}>
+      <Stack.Screen name="(auth)" />
+      <Stack.Screen name="(tabs)" />
+    </Stack>
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Root layout export
+// ---------------------------------------------------------------------------
+
+export default function RootLayout() {
+  return (
+    <SafeAreaProvider>
+      <ShareProvider>
+        <AuthProvider>
+          <AuthGuard />
+        </AuthProvider>
+      </ShareProvider>
+    </SafeAreaProvider>
+  );
+}
+
+const styles = StyleSheet.create({
+  loading: {
+    flex: 1,
+    alignItems: "center",
+    justifyContent: "center",
+    backgroundColor: "#f9fafb",
+    gap: 12,
+  },
+  loadingText: {
+    color: "#6b7280",
+    fontSize: 15,
+  },
+});