iOS Share Extension: pick the destination inside the share sheet

SwiftUI folder picker in the extension (WebDAV PROPFIND), account shared via
a Keychain group, upload on a background session that outlives the extension
and is finished by the app. The inbox + notification hand-off remains as the
fallback (no account / 'choose later'). Shared code moves to ios/Shared.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ios/Shared/SharedAccount.swift

@@ -0,0 +1,68 @@
+import Foundation
+import Security
+
+/// The signed-in account, as much of it as the Share Extension needs to list
+/// folders and upload: the app writes it when an account becomes active and
+/// clears it on sign-out. Compiled into both targets.
+struct SharedAccount: Codable, Equatable {
+  let serverUrl: String
+  let username: String
+  /// `Basic ...` - the app password never leaves the Keychain as plain text.
+  let authHeader: String
+  /// Shown in the picker, e.g. "alice@cloud.example.com".
+  let displayName: String
+}
+
+/// Keeps the [SharedAccount] in a Keychain access group both the app and the
+/// extension are entitled to (`keychain-access-groups`). The group's full id
+/// carries the signing team's prefix, so it's injected into each target's
+/// Info.plist as `NooKeychainAccessGroup` (= `$(AppIdentifierPrefix)` +
+/// `dev.ayushya.noo.shared`) instead of being hard-coded - both processes
+/// then always agree on it, with or without a team.
+enum SharedAccountStore {
+  private static let service = "dev.ayushya.noo.shared-account"
+  private static let account = "active"
+
+  static var accessGroup: String? {
+    Bundle.main.object(forInfoDictionaryKey: "NooKeychainAccessGroup") as? String
+  }
+
+  private static func baseQuery() -> [String: Any] {
+    var query: [String: Any] = [
+      kSecClass as String: kSecClassGenericPassword,
+      kSecAttrService as String: service,
+      kSecAttrAccount as String: account,
+    ]
+    if let group = accessGroup, !group.isEmpty {
+      query[kSecAttrAccessGroup as String] = group
+    }
+    return query
+  }
+
+  static func save(_ value: SharedAccount) throws {
+    let data = try JSONEncoder().encode(value)
+    clear()
+    var query = baseQuery()
+    query[kSecValueData as String] = data
+    query[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
+    let status = SecItemAdd(query as CFDictionary, nil)
+    guard status == errSecSuccess else {
+      throw NSError(domain: NSOSStatusErrorDomain, code: Int(status))
+    }
+  }
+
+  static func load() -> SharedAccount? {
+    var query = baseQuery()
+    query[kSecReturnData as String] = true
+    query[kSecMatchLimit as String] = kSecMatchLimitOne
+    var result: AnyObject?
+    guard SecItemCopyMatching(query as CFDictionary, &result) == errSecSuccess,
+      let data = result as? Data
+    else { return nil }
+    return try? JSONDecoder().decode(SharedAccount.self, from: data)
+  }
+
+  static func clear() {
+    SecItemDelete(baseQuery() as CFDictionary)
+  }
+}