docs: update the todo list after the checkout and registration work

TODO.md

@@ -2,33 +2,27 @@
 
 Remove items from this list once they are done.
 
-- upload source maps to Bugsink so release-build stack traces are symbolicated (until then
-  they're minified): create an auth token in Bugsink and set `SENTRY_AUTH_TOKEN` as an
-  [EAS secret](https://docs.expo.dev/eas/environment-variables/) — the Sentry plugin config
-  in `app.json` (url/organization/project) is already set up for the upload. Needs
-  [Bugsink ≥ 2.0.14](https://www.bugsink.com/docs/sourcemaps/); verify the project slug in
-  Bugsink matches `cnapp`
+- check that release builds upload their source maps to Bugsink: on the next EAS build, the log
+  should show the Sentry plugin's `sentry-cli` sourcemaps upload, and an error thrown in that build
+  should show symbolicated frames in Bugsink's `cnapp` project. The setup is in place:
+  `SENTRY_AUTH_TOKEN` is a sensitive EAS variable for preview and production and authenticates
+  against Bugsink 2.6.1, and the plugin config in `app.json` matches the project
 - consider turning on R8 for Android release builds (SDK 58 default, disabled via
   `android.enableMinifyInReleaseBuilds: false` in the `expo-build-properties` plugin config in
   `app.json`): smaller APK, but native Android stack traces get obfuscated unless the R8 mapping
   file reaches Bugsink, which doesn't document ProGuard/R8 mapping support. Also check whether
   Sentry needs ProGuard keep rules
-- verify the SDK 58 upgrade on devices: an expiry reminder notification and an error that lands
-  in Bugsink, on Android and an iOS EAS build
-- check the registration form's birth date wheel on iOS (`src/components/DateField.tsx`), only
-  tested on Android so far
-- verify the Stripe Checkout purchase flow end to end (needs galtinn deployed with
-  `/api/stripe/checkout-session/app/` first): a test-mode purchase on Android and iOS with `4242…`,
-  a card that requires 3D Secure and a cancel, checking the app lands back on the proof with the
-  right toast. Check Apple Pay shows inside the iOS auth session (ASWebAuthenticationSession); if
-  not, switch to `WebBrowser.openBrowserAsync` plus a `Linking` listener. Confirm Google Pay with
-  a real card in Google Wallet, and that Apple Pay, Google Pay and Link are enabled in the Stripe
-  Dashboard's Checkout settings
+- verify the SDK 58 upgrade on Android: an expiry reminder notification and an error that lands in
+  Bugsink
+- check on iOS, with an EAS build or `npm run ios` on macOS: the SDK 58 upgrade (an expiry reminder
+  notification, an error that lands in Bugsink), the registration form's birth date wheel
+  (`src/components/DateField.tsx`), and a Stripe Checkout purchase, renewal and cancel. Check Apple
+  Pay shows inside the auth session (ASWebAuthenticationSession); if not, switch to
+  `WebBrowser.openBrowserAsync` plus a `Linking` listener
+- confirm Google Pay on Checkout with a real card in Google Wallet, and that Apple Pay, Google Pay and
+  Link are enabled in the Stripe Dashboard's Checkout settings
 - once app versions using the Payment Sheet are gone, drop galtinn's `/api/stripe/payment-sheet/`
   endpoint and its `payment_intent.succeeded` handling
-- test in ios emulator? (`npm run ios`, requires macOS)
-- characters in the password input field are invisible
-- use [Expo Application Services](https://expo.dev/eas) to build and submit app to stores
 - explore Expo features:
   - add an iOS 26 liquid glass icon: a `.icon` file made with Apple's Icon Composer,
     referenced from `ios.icon` (old icon remains as fallback for older iOS); optionally