Invite page never links to the app stores on production — hostname check omits codmir.app

An invited user opening a project invitation on a phone is never offered the mobile app. The "get the app" path on the invite confirmation page silently falls back to an internal download page instead of the App Store or Play Store. The cause is a hardcoded hostname allowlist that does not include the production domain. The page checks for `codmir.com`, `www.codmir.com` and `app.codmir.com`, but production serves from `www.codmir.app`. None of the three ever match, so the production branch is unreachable and every mobile visitor takes the development fallback. This fails silently rather than erroring: the fallback page returns HTTP 200, so there is no broken link, no 404, and nothing in the logs. It simply never sends anyone to a store. A second, independent defect sits behind the same code path: the iOS link is built with a placeholder App Store ID (`id0000000000`). Even once the hostname check is corrected, iOS visitors would land on a dead App Store page. The Android link appears correct — its package identifier matches the one declared by the mobile app. Impact: this sits on the new-user acquisition path. Accepting an invitation is the first thing a new user does, and on mobile the app is the intended destination. Both defects are on that path, and the silent-fallback behaviour means it can persist indefinitely without generating a single error report.