fix: display the overlay during the selfie step of the Bridge KYC flow

[Nodirbek75]

No description provided.

[islandbitcoin]

Thanks @Nodirbek75 — the approach is right and the change is low-risk. The core fix is the camera enablement, and that's correct:

✅ Makes sense

• allowsInlineMediaPlayback + mediaPlaybackRequiresUserAction={false} are exactly what's needed for the selfie camera to initialize inline without a tap gesture — that's almost certainly why the overlay wasn't appearing (no camera stream → no overlay). allowsFullscreenVideo={false} keeps it inline. Good.
• Dropping touch-action: manipulation + the maximum-scale=1/user-scalable=no lockdown to let the KYC SDK's auto-capture work is reasonable, and you kept input,textarea,select{font-size:16px} — which is the actual iOS input-zoom guard — so relaxing user-scalable shouldn't reintroduce the focus-zoom issue.
• scrollEnabled + the content-inset flags are sensible for the form/overlay layout.

🟠 One thing to tighten

• The legal-link match went from url.includes("www.bridge.xyz/legal") → url.includes("/legal"). That now Linking.openURL()s any URL containing /legal during the ToS step (e.g. a non-Bridge host). It's low risk (the WebView content is Bridge-controlled), but since it shells out to the external browser, I'd scope it to the host — e.g. check request.url host endsWith bridge.xyz and path includes /legal. If the reason for the change is that the links are on bridge.xyz/legal (no www) or a *.bridge.xyz subdomain, a host-suffix check covers that cleanly.

🙏 Before merge

• On-device confirmation: this is a camera/overlay fix that can't be verified in code or CI (and there are no checks on this branch). Please confirm on a real iOS device that the selfie overlay renders and auto-capture works — a short screen recording or before/after screenshots in the PR description would make this easy to sign off (the description is currently empty).
• Note this targets feat/fygaro, not main — just flagging the stacking is intentional.

Net: code LGTM; happy to approve once the on-device behavior is confirmed and the /legal match is host-scoped (or you confirm you'd rather keep it broad).

[islandbitcoin]

Pushed 5f1c6499 for the /legal point — scoped the external-open to the bridge.xyz host (any subdomain) + a /legal path, instead of matching any URL containing /legal:

```js
const isBridgeLegal =
/^https?://([a-z0-9.-]+.)?bridge.xyz//.test(url) &&
url.includes("/legal")
```

@Nodirbek75 hope you don't mind me pushing directly. Verified the match against www.bridge.xyz/legal, bare bridge.xyz/legal, and subdomains (all open externally), while evil.com/legal, bridge.xyz.evil.com/legal, and evil.com/x?ref=bridge.xyz/legal are all rejected.

Still outstanding from the review: on-device confirmation that the selfie overlay/auto-capture works (the camera-enablement bits can't be verified in code/CI) — a short screen recording in the description would let this get an approval.