Ah, the joys of CORS.
Have you tried building your app and seeing if it works on-device? The PhoneGap Developer app is not a perfect simulation of your app as it would behave when built standalone, and CORS stuff is one of several edge cases where PGDev app works differently.
Thanks for that -- we'll test it out this week by building the app for real via iOS `Test Flight`. Will comment again on how successful it is.
OP here - just following up with this incase others see it. Turns out the issue wasn't with $http at all. We set `//api.site.com` as our baseURI, a trick with primarily browser apps to use it's current protocol and apply it to every call to an API. This `//` worked fine with the browser, but not with the mobile app. Adjusting it to be `https://api.site.com` made the whole system work as expected.