chore(release): bump version to 2.1.6 (build 131)

Version: CURRENT_PROJECT_VERSION 130 -> 131 (project.yml, AGENTS.md, READMEs,
docs/llms.txt).

fix(flow): host-app identification now compiles in every build configuration
(Debug, TestFlight, Release). The arbiter probe and HostAppIdentity were
DEBUG-only, so TestFlight/App Store builds never knew the host bundle id and
could not auto-return after a startflow handoff. Debug-only logging and the
Home test card are unchanged.

Also includes the pending work in the tree:
- Home: single account/setup card surface (HomeAccountSurfacePolicy/Views)
- Wide screens: voice key row and centred mic placement, iPhone Duo layout
- Keyboard: clipboard skill ranking and AI skill layout updates
- Debug: account session handoff to the Simulator (+ import script)
- Docs: portfolio assets, privacy policy URL, site/README refresh

docs/privacy/index.html

@@ -88,7 +88,7 @@
   <p>User-configured cloud ASR and LLM requests go directly to the provider you configure. Managed-credit requests go through <code>account.osglab.com</code> to the managed ASR or LLM provider. Apple processes Sign in with Apple and StoreKit purchases. AI skills may also hand generated data to Apple Shortcuts or open a route in Apple Maps, Amap, or Baidu Maps. Public suggestions and update pages are served by <code>key.osglab.com</code> and <code>download.osglab.com</code>. Optional Mac models are downloaded from Hugging Face. Each service's privacy policy applies.</p>
 
   <h2>Website analytics</h2>
-  <p>The OSGKeyboard website at <code>hkgood.github.io/OSGKeyboard</code> — including the in-app What's New page loaded from that site — uses Google Analytics 4 (gtag.js) to measure page visits, approximate region, and device or browser type. It runs only on these web pages: it is not an app SDK, never sees keyboard input, audio, transcripts, clipboard content, prompts, or API keys, and is not controlled by the in-app analytics toggle. Data processed by Google is governed by <a href="https://policies.google.com/privacy">Google's privacy policy</a>; you can block it with a browser content blocker or <a href="https://tools.google.com/dlpage/gaoptout">Google's opt-out add-on</a>.</p>
+  <p>The OSGKeyboard website at <code>osg.osglab.com</code> uses Google Analytics 4 (gtag.js) to measure page visits, approximate region, and device or browser type. It runs only on these web pages: it is not an app SDK, never sees keyboard input, audio, transcripts, clipboard content, prompts, or API keys, and is not controlled by the in-app analytics toggle. The in-app What's New page is served from <code>download.osglab.com</code> and does not run Google Analytics. Data processed by Google is governed by <a href="https://policies.google.com/privacy">Google's privacy policy</a>; you can block it with a browser content blocker or <a href="https://tools.google.com/dlpage/gaoptout">Google's opt-out add-on</a>.</p>
 
   <h2>Data retention</h2>
   <p>Settings remain on your device until you delete the app or reset settings. When iCloud settings sync is enabled, API keys replicate through iCloud Keychain and eligible preferences, statistics, dictionary data, voice history, and saved custom styles may sync through your private iCloud account. Voice history is capped at 300 entries and can be cleared from History or by resetting settings; clearing all history also removes retained style-prompt snapshots. A generated style is stored only after you review and save it. Clipboard history remains device-local, is capped at 15 entries, has no fixed expiry, and remains when capture is turned off or settings are reset; use the separate confirmed clear action to delete it. Chinese and English typing-learning data stays local and can be cleared from typing settings without deleting the personal dictionary. Downloaded Mac speech models remain until you remove the model in the app or delete its local files.</p>
@@ -156,7 +156,7 @@
   <p>用户自备的云端 ASR 与 LLM 请求直接发送到你配置的服务商；托管积分请求经 <code>account.osglab.com</code> 发送到托管 ASR 或 LLM 服务商。Apple 处理 Apple 登录与 StoreKit 购买。AI 技能也可能把生成数据交给 Apple 快捷指令，或在 Apple 地图、高德地图、百度地图中打开路线。公开建议与更新页面分别由 <code>key.osglab.com</code>、<code>download.osglab.com</code> 提供；可选 Mac 模型从 Hugging Face 下载。各服务的隐私政策适用。</p>
 
   <h2>网站分析</h2>
-  <p>OSGKeyboard 网站（<code>hkgood.github.io/OSGKeyboard</code>，包括 App 内从该站点加载的「更新说明」页面）使用 Google Analytics 4（gtag.js）统计页面访问量、大致地区与设备或浏览器类型。它仅运行在这些网页中：不是 App 内 SDK，无法接触键盘输入、语音、转写文本、剪贴板内容、提示词或 API 密钥，也不受 App 内「产品分析」开关控制。Google 处理的数据适用其<a href="https://policies.google.com/privacy">隐私政策</a>；你可以通过浏览器内容拦截器或 Google 的<a href="https://tools.google.com/dlpage/gaoptout">停用插件</a>将其屏蔽。</p>
+  <p>OSGKeyboard 网站（<code>osg.osglab.com</code>）使用 Google Analytics 4（gtag.js）统计页面访问量、大致地区与设备或浏览器类型。它仅运行在这些网页中：不是 App 内 SDK，无法接触键盘输入、语音、转写文本、剪贴板内容、提示词或 API 密钥，也不受 App 内「产品分析」开关控制。App 内「更新说明」页面由 <code>download.osglab.com</code> 提供，不运行 Google Analytics。Google 处理的数据适用其<a href="https://policies.google.com/privacy">隐私政策</a>；你可以通过浏览器内容拦截器或 Google 的<a href="https://tools.google.com/dlpage/gaoptout">停用插件</a>将其屏蔽。</p>
 
   <h2>数据保留</h2>
   <p>设置保留在设备上，直至卸载或重置。开启 iCloud 设置同步后，API 密钥经 iCloud 钥匙串同步，可同步的偏好、统计、词库、语音历史和已保存的自定义风格可能经私有 iCloud 账户同步。语音历史上限 300 条，可在「历史」页清空或通过重置设置清除；清空全部历史也会删除保留的风格 Prompt 快照。生成的风格只有在你检查并保存后才会写入。剪贴板历史仅保存在本机，上限 15 条，没有固定过期时间；关闭采集或重置设置均会保留，需使用单独确认的清空操作删除。中英文输入学习数据仅留本机，可在输入设置中单独清除且不影响个性词库。下载的 Mac 语音模型会保留到你在应用中移除模型或删除本地文件。</p>