feat(android): add bounded native shell

[ctwhome]

Summary

• add a bounded Capacitor 8 Android shell that loads the canonical HUE server rather than creating a second Project, Session, transcript, or execution authority
• add validated same-origin Project, Session, and Quick Idea routing with release HTTPS/config-consistency gates and debug-only loopback HTTP
• add a functional Quick Idea AppWidget, dynamic and explicitly user-pinned generic Project/Session shortcuts, stale pinned-shortcut disabling, and private generic native notification channels
• disable Android backup/data extraction, keep native credentials out of scope, and remove the unused Local Notifications plugin/permission surface
• document the Capacitor decision, maintenance/privacy/signing boundary, 16 KB compatibility gate, and repeatable SDK/emulator proof workflow

Real Android proof

Executed HUE_ANDROID_HTTPS_ORIGIN=<tailnet HTTPS origin> ./scripts/android-proof.sh against Medium_Phone_API_36:

• Android 16 / API 36 / arm64-v8a / 16 KB pages
• configured HTTPS Project and Session links dispatch to studio.ctw.hue/.MainActivity and load HUE
• remote HUE page exposes the registered HueNative bridge
• real bound AppWidgetHost surface click opens the non-auto-submitting Quick Idea draft
• dynamic Project + Session shortcuts add/remove successfully
• explicit pinned Project shortcut uses a generic label/hashed ID and is disabled when authority is removed
• completion, attention, and error channels exist; test notification is private, generic, and opens the exact safe Session
• APK contains no .so libraries

The current tailnet host has no production /.well-known/assetlinks.json. The proof therefore records bounded emulator link approval and exact Android dispatch separately; production Digital Asset Links remain an explicit deployment/release requirement.

Verification

• bun test — 391 passed, 4 opt-in integration tests skipped
• bun run --cwd app check — 0 errors, 0 warnings
• bun run --cwd app build — passed
• HUE_E2E_PORT=4503 bun run --cwd app test:e2e — 55 passed
• bun run verify in docs — 87 HTML pages and 54 issue briefs verified
• Gradle JVM tests, lint, debug APK, and Android test APK — passed; lint has 0 errors
• release HTTP validation — rejected
• release HTTPS validation — passed
• mismatched Capacitor/Gradle release origin — rejected
• connected API 36 suite — 6 normal tests passed; 4 proof helpers intentionally skipped in the aggregate and then passed individually
• shellcheck, Prettier, and git diff --check — passed

Distribution boundary

This is a debug/direct-install proof only. It does not publish, enroll signing, submit to a store, or establish production credential storage/update provenance.

Closes #86