EAS cloud builds have no source for three EXPO_PUBLIC_* variables

[toruiwasa]

Found in review of PR #94.

Field	Contents
Goal	An EAS cloud build produces a binary with working Supabase and API endpoints, and the repo states where those values come from.
Context	Review of PR #94 (feat/mobile-scaffold). apps/mobile/eas.json injects only EXPO_PUBLIC_APP_ENV in all three profiles; .env is gitignored (root .gitignore) and EAS does not upload it, and no .easignore overrides that. So EXPO_PUBLIC_SUPABASE_URL, EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY and EXPO_PUBLIC_API_URL have no in-repo source for any profile. apps/mobile/app.json has no extra.eas.projectId, so no EAS project is linked yet and there was no dashboard state to verify against — PR #94 therefore documented the gap in .env.example instead of committing values.
Scope	Link the EAS project, then supply the three variables per profile (development / preview / production). Open decision: whether they live in the env blocks of eas.json (they are EXPO_PUBLIC_*, hence inlined into the binary and not secret — so committing them is defensible and self-documenting) or as EAS environment variables on expo.dev (matches how apps/web keeps values out of the repo and defers to Vercel env vars). Whichever is chosen, .env.example must stop pointing at this issue and state the actual mechanism.
Test boundary	No unit tests. Verified by eas build --profile development and confirming the built app reaches Supabase and the API.
Done when	A cloud build on every profile starts with all four EXPO_PUBLIC_* variables defined, and apps/mobile/.env.example names where each comes from.
Branch	infra/eas-build-env
Dependency	Blocks #12 (Task 9) reaching a device via a cloud build — #12 is the task whose code first reads these variables. Not a blocker for local expo run:* builds, which read .env.
Risk	HIGH — the failure is silent at build time and only appears at runtime as undefined endpoints, on whatever build is first handed to a tester or store reviewer.

Per CLAUDE.md > Deployment configuration changes, confirm the current expo.dev state before changing any of these values.