NewDot wildcard deeplinks #99412

Sub-issue of #98153, tracking the NewDot wildcard deeplink change from #99347 (+ Mobile-Expensify#14073).

Problem

The set of new.expensify.com / staging.new.expensify.com paths that open the app is a hand-maintained allowlist duplicated across the iOS AASA and Android manifests (App + Mobile-Expensify). Every new NewDot route requires a native change to be deep-linkable, and any path not in the list opens in the browser instead of the app.

Solution

Replace the hand-maintained NewDot deeplink path allowlists with a wildcard, so every new.expensify.com / staging.new.expensify.com path opens the app and new routes need no native change:

• iOS: AASA components collapsed to {"/": "*"}.
• Android: pathPrefix entries replaced by host-only <data>, mirrored in Mobile-Expensify.
• Expensify Classic (www.expensify.com / expensify.com) links are unchanged — the wildcard must not leak into the Classic domains.

Test steps

Note on iOS: the AASA is fetched from the server, so the wildcard only takes effect once this branch's .well-known/apple-app-site-association is deployed to new.expensify.com / staging.new.expensify.com. To test before deploy, append ?mode=developer to the applinks: entries in the entitlements and enable Settings > Developer > Associated Domains Development on the device.

1. Android — previously unlisted NewDot path opens the app (standalone + HybridApp)

1. Open a path that was not in the old allowlist, e.g. https://new.expensify.com/workspace/<policyID>/members → verify the app opens directly on the Workspace members page (not Chrome).
2. Open a path that was already in the allowlist, e.g. https://new.expensify.com/r/<reportID> → verify the report opens in the app exactly as before (no regression).
3. Open an unsupported path, e.g. https://new.expensify.com/some-unsupported-path → verify the app opens on the Not found page.

2. Android — Expensify Classic links are unchanged (HybridApp)

1. Open https://www.expensify.com/inbox → verify the app opens on the OldDot Inbox (unchanged).
2. Open https://www.expensify.com/expensify-classic/hubs/getting-started/ (a Classic path not in the OldDot allowlist) → verify it opens in the browser and not the app (wildcard did not leak into Classic domains).

3. iOS — universal links resolve to the app (standalone + HybridApp)

1. Build/install with the AASA wildcard available (see note above).
2. Long-press a https://new.expensify.com/settings/profile link in Notes/Messages → verify "Open in New Expensify" is offered and opens Settings > Profile in the app.
3. Repeat with a previously unlisted path such as https://new.expensify.com/workspace/<policyID>/members → verify it opens in the app rather than Safari.
4. On HybridApp, tap https://www.expensify.com/inbox → verify it opens the OldDot Inbox as before (www.expensify.com serves its own AASA, unchanged by this work).

QA steps

Same as tests, Android only. iOS relies on the server-deployed AASA, so verify on staging/production once the .well-known/apple-app-site-association change is deployed.