feat(sample-app): no-account default models, Play Store readiness + adaptive multi-device UI prototype

[sagar-develop]

This PR has two parts: (1) the Play Store readiness / no-account model work, and (2) a design prototype for an adaptive multi-device UI redesign. They share this branch; the UI prototype is docs-only (docs/prototype/) and ships no code changes.

---

Part 1 — No-account default models + Play Store readiness

Why

To put NativeLM on the Play Store, two things had to change: a fresh install needed to reach a working model without forcing every user to create a Hugging Face account first, and the app needed the legal/packaging pieces a submission requires. This PR does both in one pass.

What "no HF token" means

Hugging Face models are either gated (Gemma — needs login + license accept + an Authorization: Bearer header) or public (Apache-2.0 / MIT — direct download, no account). The catalog already encodes this via ModelDescriptor.requiresAuth. This PR leans on it so the ungated models become the default path.

Changes

Model management — no-account first run

• NativeLmViewModel.recommendedModelId — picks the largest ungated LLM whose RAM floor the device clears (Qwen3 0.6B → DeepSeek-R1 1.5B → Phi-4 mini → Qwen3 4B), plus a downloadRecommended() convenience.
• Recommended / Advanced split in the model screen:
  • Recommended — ungated models, no token, with the device's pick badged Recommended.
  • Advanced — Hugging Face account — a collapsible section holding the gated Gemma tier + the token field (auto-expands if a token is already saved).

First-run compliance

• Onboarding's final slide gains a terms/source gate linking the AGPL source and Google's Gemma Terms, clarifying that downloaded models carry their own licenses.
• Onboarding copy updated: start with a free model, no account needed.

Security hardening

• Cleartext disabled — usesCleartextTraffic="false" + res/xml/network_security_config.xml. Model downloads are HTTPS; local P2P sync uses raw sockets carrying AES-GCM ciphertext and is unaffected (verified against sync/SocketTransfer.kt).

Docs (the "Play Store ready" deliverable)

• PRIVACY.md — hosted-ready, zero-telemetry privacy policy (permission-by-permission).
• PLAY_STORE.md — detailed submission checklist: AAB build/signing, Data Safety answers, permission justifications, content rating, listing assets, AGPL + Gemma compliance, and recommended follow-ups.
• Updated CHANGELOG.md and sample-app/README.md.

Deferred (documented, not in this PR)

Per scope decision, foreground-service / WorkManager downloads (so multi-GB downloads survive backgrounding) and model-revision + SHA pinning are written up as follow-ups in PLAY_STORE.md §9.

Testing notes

No Android SDK in the CI/dev sandbox, so this wasn't compiled here — changes are UI/docs/manifest only and were reviewed by hand. Please build the release AAB (./gradlew :sample-app:bundleRelease) and smoke-test on an internal track: confirm the recommended model downloads with no token, the gated download still shows the license reminder, and P2P sync still works with cleartext disabled.

---

Part 2 — Adaptive multi-device UI redesign (prototype)

A premium-minimal refresh of the existing identity plus a full multi-device adaptive UI (phone / foldable / tablet), delivered as an interactive HTML prototype for sign-off — not shipped Compose yet. The brand is unchanged: sage #7FA980, warm canvas, Inter + JetBrains Mono (mono reserved for technical metadata). This elevates hierarchy, spacing, surfaces, and empty/loading states on top of what's locked in Color.kt / Type.kt.

Files

• docs/prototype/index.html — self-contained, offline. Top bar toggles Device (Phone · Foldable · Tablet) and Theme (Light · Dark); the left list jumps between screens. The same screen reflows across breakpoints.
• docs/prototype/DESIGN.md — tokens (8pt spacing, elevation, radius), breakpoint/navigation table, per-screen adaptive behavior, and the Compose implementation plan.

Adaptive system

Window class	Navigation	Layout
Compact (phone)	top-bar hamburger → modal drawer	single pane
Medium (foldable)	navigation rail	single detail pane, capped width
Expanded (tablet)	rail + persistent list pane	list-detail two-pane

Destinations are identical across sizes — Chat · Models · Sources · Studio · Settings. Intended Compose mapping: NavigationSuiteScaffold for the shell, ListDetailPaneScaffold for two-pane screens.

Screens covered

Chat (with two-pane on tablet), Models, Sources, Studio, Settings, PDF viewer, and the Onboarding / Splash / Lock flows — rendered with faithful copy from the current app.

Open questions for review

• Tablet Chat uses a persistent conversations pane — keep it, or keep chat full-width and only split Sources/Studio?
• The empty-chat greeting + suggestion chips are new (not in today's app) — keep or revert to the current minimal greeting?

Next steps (after sign-off)

Iterate on the prototype, then implement in Compose, staged: Chat → Models → Settings → Sources → Studio → PDF → flows.

https://claude.ai/code/session_01GY7vyycq3iQTQxiooMnxJW

---

Generated by Claude Code

[sagar-develop]

Part 2 is now implemented in Compose (no longer docs-only)

Per the discussion that a UI-enhancement branch needs shipped code, the adaptive multi-device prototype in docs/prototype/ is now built in Compose and verified on real hardware. Also merged latest main into this branch (resolved cleanly; the engine-extraction/chart PRs that landed since this branched).

What landed (commit 496fe9c):

• Adaptive shell (AdaptiveShell.kt) — NavigationSuiteScaffold over the five destinations. Compact = no rail, existing hamburger + modal drawer (phones unchanged); Medium/Expanded = navigation rail. Flows (splash/onboarding/lock/pdf) stay outside the shell; NativeLmApp collapses the five screen routes into one shell route.
• Chat two-pane on Expanded — persistent conversations list (shared ConversationsList) + thread; hamburger hidden when the pane is present. (Resolves the "tablet Chat" open question → two-pane, per sign-off.)
• Empty-chat greeting + suggestion chips — project-aware, one-tap send. (Resolves the "greeting + chips" open question → keep, per sign-off.)
• Theme tokens (Dimens.kt) — 8pt spacing, radius scale wired into MaterialTheme.shapes, and WideContent() capping reading columns at 760dp so Models/Sources/Studio/Settings don't stretch on tablets.
• Adaptive deps (material3-window-size-class + material3-adaptive*), all BOM-managed.

Verified on-device (release build):

• Phone — Realme CPH2723 (Compact): drawer + hamburger, greeting + three suggestion chips, chip one-tap → on-device reply. No regression.
• Tablet — Redmi Pad SE, portrait (Medium): navigation rail + single pane, content capped/centered.
• Tablet, landscape (Expanded): rail + Chat two-pane (conversations | thread).
• No-account path: tapping Download on an ungated model (Qwen3 0.6B) starts downloading with no token prompt; DeepSeek-R1 1.5B badged Recommended (largest ungated model that fits RAM); Phi-4/Qwen3-4B greyed "Not enough RAM".

Deferred (noted, not in this PR): Sources and Studio list+detail two-pane on Expanded (rail makes them multi-device today; single-pane within the shell is functional). Not yet verified from the Part-1 testing notes: gated-Gemma license reminder dialog and P2P sync with cleartext disabled (raw-socket transfer is unaffected by usesCleartextTraffic=false per SocketTransfer.kt, but a 2-device round-trip wasn't run).