Update CBS Mobile App codebase

src/config/env.ts

@@ -1,5 +1,46 @@
+/**
+ * Host running the CBS backend. Swagger for it is at `/swagger-ui/index.html`.
+ *
+ * This has to be an address the *phone* can reach, which is not the same thing
+ * as one that works in a browser on the dev machine: a VM-only or
+ * different-subnet address resolves fine on the laptop and is simply invisible
+ * to the handset, and that failure reads like the app being broken. `localhost`
+ * is wrong for the same reason — on a device it means the device itself.
+ *
+ * This is a named host on an internal domain, not an IP, so it resolves only
+ * where the DNS that serves `.lincpay` is reachable — the office network or
+ * the VPN. A handset on mobile data, or on a guest network without that
+ * resolver, fails to resolve it at all and the app looks like the backend is
+ * down. Note there is no port here: this host answers on the default 80, unlike
+ * the `:8089` LAN addresses this build was aimed at before.
+ *
+ * Plain HTTP, so it depends on cleartext traffic being allowed for this host
+ * specifically. Both platforms gate that by host and neither tells the app why
+ * a blocked request failed, so a change here has to be checked against:
+ *
+ *   - here,
+ *   - `android/app/src/main/res/xml/network_security_config.xml`,
+ *   - `NSExceptionDomains` in `ios/BankCBS/Info.plist` — a bare IP literal is
+ *     already covered there by `NSAllowsLocalNetworking`, but a *named* host
+ *     is not and needs its own entry.
+ */
+const API_ORIGIN = 'http://mobile-banking-backend.lincpay';
+
 export const env = {
-  apiBaseUrl: 'https://sandbox.bankcbs.dev/v1',
+  /** CBS backend origin. */
+  apiOrigin: API_ORIGIN,
+  /** Every documented endpoint lives under this prefix. */
+  apiBaseUrl: `${API_ORIGIN}/api/v1`,
+  /** Organisation the app is branded for; sent at registration and at sign-in. */
+  orgId: 'ORG001',
+  /**
+   * Modules with no backend behind them yet — cards, loans, insurance, deposits,
+   * the dashboard and the agent app — still resolve from fixtures. Registration,
+   * sign-in, accounts/MMID and payees always call the live API regardless.
+   */
   useMockServer: true,
-  sessionTimeoutMs: 300000,
+  /** Server-enforced idle window; any authenticated call refreshes it. */
+  sessionTimeoutMs: 300_000,
+  /** How long before the idle cut-off the user is warned. */
+  sessionWarningMs: 60_000,
 };