[the-luap]

This adds iOS/iPadOS management directly to OpenUEM while retaining its existing Windows software deployment workflows. The shared device view includes mobile inventory, OS/build information, installed apps, configuration profile revisions and assignments, and native declarative OS update policies.

The Apple implementation uses the console's PostgreSQL database and a separate public TLS listener in the same process. It includes single-use enrollment with individual identities, APNs, durable commands, profile verification, scoped revocation, encrypted credentials/payloads, and model-specific Apple release catalog validation. It does not depend on NanoMDM.

Validation:

• Native protocol/PostgreSQL/TLS and console route tests passed with the Go race detector; template rendering tests passed.
• Existing Windows deployment model tests and Linux/Windows builds passed. The Docker image built successfully.
• The actual console was started with isolated PostgreSQL and NATS. Authenticated browser workflows and a mutual-TLS protocol simulator verified enrollment, OS/build and app inventory, profile revisions/removal, queued work across a server restart, and DDM compliance transitions. The Windows deployment page remained accessible through the same session. These are simulated device results; test APNs traffic was deliberately blocked.
• A live Apple catalog fetch exposed and verified the fix for Apple's root certificate missing from Linux trust stores. The catalog client adds the official public root without disabling TLS verification. The update form now selects an exact version/build pair, and enrollment avoids an immediate duplicate inventory batch.
• The complete upstream models suite has SMTP/user expectation failures reproduced on unmodified upstream commit 5604db7. GitHub CI covers the supported regression checks.

This remains a draft pending physical-device acceptance using real APNs credentials, a public HTTPS endpoint, managed iOS/iPadOS hardware, and a Windows deployment target. Manual enrollment is implemented; ADE/ABM, SCEP, automatic device identity renewal, iOS app deployment and granular RBAC are not included. See docs/native-ios-operations.md for setup, limitations and the acceptance checklist.