Add API security guards, rate limiter, and manual test checklist

Implement strict CORS enforcement and per-IP rate limiting in the Next.js middleware. Add input validation helpers for
coordinates and request body size limits. Introduce SSRF protection for calendar URL fetching. Update mobile settings to
support new transport options and arrival buffers. Include a comprehensive manual testing checklist for integration
verification.

apps/mobile/src/screens/SettingsScreen.tsx

@@ -37,6 +37,9 @@ export function SettingsScreen({ navigation }: ScreenProps) {
   const [notifSettings, setNotifSettings] = useState<ReminderSettings>({
     bufferMinutes: 30,
     enabled: true,
+    arrivalBufferMinutes: 5,
+    showWalkingOption: true,
+    showBikeOption: true,
   });
   const [locPermission, setLocPermission] = useState<'granted' | 'denied' | 'prompt'>('prompt');
   const searchTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);

apps/mobile/src/store/eventStore.ts

@@ -14,6 +14,9 @@ const NOTIFICATIONS_KEY = '@timetoleave_notifications';
 const DEFAULT_NOTIFICATION_SETTINGS: ReminderSettings = {
   bufferMinutes: 30,
   enabled: true,
+  arrivalBufferMinutes: 5,
+  showWalkingOption: true,
+  showBikeOption: true,
 };
 
 // ── Helpers ───────────────────────────────────────────