Web-app to mobile app build (iOS Android)

Slopestyle Mobile App: Contractor Scope Overview and goal: I'm hiring one mobile developer to turn Slopestyle, a working web platform for BC mountain towns, into iOS and Android apps that Apple and Google will approve. Slopestyle brings housing, community Boards, buy and sell, and local businesses together for towns like Whistler, Squamish and Pemberton, as a quieter alternative to Facebook groups. The web app is live with a small group of members, and early feedback has been strong. The goal is a store-ready app that matches the core web experience, uses the same backend, and meets the stores' rules for apps with user-generated content. What exists today: The web app, backend and moderation tools are built and tested, so this project is about the mobile client, not a new product. • Front end: React, TypeScript and Vite, built with Loveable (an AI-assisted tool), live at slopestyle.app • Backend: Supabase (Postgres, Auth, Storage, Realtime and Edge Functions) in my own account, with row-level security • Sign-in: email and password, and Google, with Cloudflare Turnstile on sign-up and password reset • Email: Resend, with branded message notifications • Features: housing listings, Boards, Marketplace, business pages, a Locals member directory, messaging, reporting, an admin moderation page and listing-outcome tracking • In development: Events • Security: the web app has had several reviews covering access control, uploads and injection The web app at phone widths is the visual reference. I'll share screens and access once we start. Scope of version 1: Version 1 covers the core member experience on iPhone and Android, using the existing backend. [ ] Sign up, sign in (email, Google and Apple) and password reset [ ] Browse and post: housing, Marketplace, Boards, businesses and Locals [ ] Messaging with real-time updates [ ] Photo and video upload from the camera or library [ ] Push notifications for new messages (opt-in), with notification settings [ ] Sharing to other apps and links that open the right post or listing [ ] Reporting, blocking users and in-app account deletion Out of scope for version 1: payments and in-app purchases, advertising tools, the admin and moderation pages (these stay on the web), Events (unless finished before kickoff), and feed ranking. Technical approach I want your recommendation, and I'd like your proposal to compare two routes. 1. A native shell around the existing React web app (for example Capacitor), with real native features added. 2. A React Native (Expo) app that reuses the Supabase queries and logic but rebuilds the screens. Constraints that apply to both: • One Supabase backend shared with the web app, with no changes to existing database policies without my approval • The web app is maintained separately in Loveable, so any schema change must be coordinated with me first • TypeScript preferred • Apple can reject apps that are essentially a website in a wrapper, so the approach must deliver real native value, such as push, sharing and the camera App store requirements The stores' rules for apps with user-generated content shape what must be built before submission. • Apple requires content filtering, a way to report offensive content with timely responses, the ability to block abusive users, and published contact details • Apps that let people create accounts must offer account deletion inside the app • Apps with social sign-in such as Google have been flagged for lacking Sign in with Apple, so please confirm the current rule • A working privacy policy link, accurate Apple privacy labels and the Google Play data safety form • Real native functionality beyond a web wrapper • Google Play: a new personal developer account must run a closed test with at least 12 testers for 14 continuous days before production. I will provide the testers I'll create the developer accounts. I need you to guide the submission, write the review notes, and fix one or two rounds of store feedback. Access, security and legal You'll work against a copy of the system with fake data, and everything you build belongs to me. • A staging Supabase project with fake data. No production keys and no service-role key are shared • Private repository access through GitHub, with secrets kept in environment variables and never committed • A signed confidentiality agreement and a written IP assignment before any code is shared • A list of every third-party SDK you add, for the privacy labels, with no unvetted SDKs • Developer accounts stay in my name or my company's name, and you're added as a team member with limited roles • All access is revoked when the project ends Deliverables and milestones Work runs in five milestones, with payment tied to each one. 1. Discovery: a written recommendation on the approach, a plan, and a fixed quote 2. Prototype: sign-in, browsing, posting and messaging running on real devices through TestFlight and Google internal testing 3. Feature-complete beta: push notifications, s